Unlike hubs, switches usually prevent promiscuous sniffing. In
a switched network environment, a sniffer is limited to capturing
broadcast and multicast packets and those traffic sent or received
by the same PC as the sniffer running one.
However, most modern switches support SPAN, or called "port
mirroring", which is an advanced feature that enables switches
to forward all packets to one or more switch ports and allows sniffers
capture network traffic of the whole LAN. If you switch doesn't
support such monitoring feature, please refer to Q5
in our FAQ page.
Here is a 3-step instruction on how to configure SPAN for Cisco
Catalyst 1900 Series Switch.
|