Re: [Nolug] Packet sniffing on switched network

From: Dustin Puryear <>
Date: Fri, 01 Feb 2008 11:17:21 -0600
Message-ID: <>

There is a simple solution:

internet -> dsl modem -> pix -> hub -> switch ...
                                  |-> ntop system

You get no performance hit. The hub is a lot faster than your Internet
connection will ever be and your network traffic is still on the switch.

This is the typical solution for your problem.

Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
Author, "Best Practices for Managing Linux and UNIX Servers"
Identity Management, LDAP, and Linux Integration
Chris Jones wrote:
> I have a client whose internet is running very slowly.  I suspect that 
> there's a lot of traffic coming from somewhere, so I need to sniff the 
> traffic to figure out where it's coming/going.  Problem is, this is a 
> switched network.
> The network is a fairly typical setup, going like this:
> internet -> dsl modem -> cisco pix -> linksys switch -> LAN
> I can't find a way to get this linksys to go promiscuous, so I'm 
> thinking maybe I could set up some kind of machine with two nic's, and 
> have it forward all traffic from one nic to the other, and have the 
> machine just analyze all traffic as it passes through.  Not sure if 
> that's the best route, or maybe one of you guys have run across a better 
> option?  If that is the best way to go, does anyone know of a good free 
> product to do this?  Or maybe I can somehow use SNMP to pull this info 
> out of the pix?  Any suggestions?
Nolug mailing list
Received on 02/01/08

This archive was generated by hypermail 2.2.0 : 12/19/08 EST