sniffing on a switched LAN

Posted by shodanex on Server Fault See other posts from Server Fault or by shodanex
Published on 2009-10-09T08:57:51Z Indexed on 2010/03/27 23:53 UTC
Read the original article Hit count: 346

Filed under:

sniffer

|

switch

Hi,

I often find myself in the position of having to sniff on a connection between for example an arm board I am developing on, and another computer on the network, or out of the network.

The easy situation is when I can install a sniffer on the computer talking to the embedded device. When it is not possible, I currently install an old 10Mb/s HUB. However I am afraid my HUB might stop working, and I would like to know some alternative.

Here are the alternatives I could think of :

Buy another HUB. Is that still possible ?
Have some sort of ethernet sniffing bridge, like what they do for USB. I am afraid this kind of device is expensive.
use ARP poisoning.

© Server Fault or respective owner

Related posts about sniffer

Writing an http sniffer (or any other application level sniffer)

as seen on Stack Overflow - Search for 'Stack Overflow'
Dear all, I am trying my hands understanding PCAP libraries. I am able to apply a filter and get the TCP payload at port 80. But what next ? How can I read the HTTP data - suppose I want to know the "User Agent" field value in the http header..how should I proceed ? I have searched the website (and… >>> More
URL Sniffer based on NetFilter SDK

as seen on Code Project - Search for 'Code Project'
How to use NetFilter SDK to develop a URL Sniffer >>> More
http sniffer not working in a LAN setting

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi , I wrote a http sniffer program , first ran it in my standalone pc < fedora OS , and it worked well. And when i tried this in a LAN setting < bus-LAN , fedora OS again , and set the eth0 to promisc mode , the program captures only the URLs browsed by the system in which it is running … >>> More
i am using winsock2.h in c language the following errors are unuderstandable help required?

as seen on Stack Overflow - Search for 'Stack Overflow'
i am going to paste here my code an errors :::: #include "stdio.h" #include "winsock2.h" #define SIO_RCVALL _WSAIOW(IOC_VENDOR,1) //this removes the need of mstcpip.h void StartSniffing (SOCKET Sock); //This will sniff here and there void ProcessPacket (unsigned char* , int); //This will decide… >>> More
Reconstructing data from PCAP sniff

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi everyone !! I am trying to sniff HTTP data through libpcap and get all the http contents (header+payload) after processing the TCP payload. As per my discussion at http://stackoverflow.com/questions/2905430/writing-an-http-sniffer-or-any-other-application-level-sniffer , I am facing problems… >>> More

Related posts about switch

Problem connecting a 3Com 2952-Plus switch to a Cisco 3750 switch

as seen on Server Fault - Search for 'Server Fault'
Connected a 3Com 2952-SFP Plus switch to a Cisco 3750 switch via fibre. There is a light on the 3Com end, but nothing at the Cisco end, and no traffic will flow. Have swapped SFP's, have swapped fibre cables, have used a different port on the Cisco, have even swapped the 3Com switch, but still no… >>> More
enable Cisco switch to communicate withe HP switch

as seen on Server Fault - Search for 'Server Fault'
I have one CISCO 2906g and hp 2626 switches i link them by MM fiber optic cable, the problem the cant communicate with each other, i verify there is no problem with cable and JBC's. win i connect other HP switch in the other end it will communicate without any problem, but not with CISCO >>> More
SQL Server database with clustered GUID PKs - switch clustered index or switch to sequential (comb)

as seen on Stack Overflow - Search for 'Stack Overflow'
We have a database in which all the PKs are GUIDs, and most of the PKs are also the clustered index for the table. We know that this is bad (due to the random nature of GUIDs). So, it seems there are basically two options here (short of throwing out GUIDs as PKs altogether, which we cannot do (at… >>> More
Repository pattern - Switch out the database and switch in XML files

as seen on Stack Overflow - Search for 'Stack Overflow'
Repository pattern - Switch out the database and switch in XML files. Hello I have an asp.net MVC 2.0 project and I have followed the Repository pattern. Periodically, I am losing access to the database server so I want to have another mechanism in place (XML files) to continue developing. It is… >>> More
MS SQL Database with clustered GUID PKs - switch clustered index or switch to sequential (comb) GUID

as seen on Stack Overflow - Search for 'Stack Overflow'
We have a database in which all the PKs are GUIDs, and most of the PKs are also the clustered index for the table. We know that this is bad (due to the random nature of GUIDs). So, it seems there are basically two options here (short of throwing out GUIDs as PKs altogether, which we cannot do (at… >>> More