Re: [Nolug] Packet sniffing on switched network

There is a simple solution:

internet -> dsl modem -> pix -> hub -> switch ...
                                  |-> ntop system

You get no performance hit. The hub is a lot faster than your Internet
connection will ever be and your network traffic is still on the switch.

This is the typical solution for your problem.

--
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com
Author, "Best Practices for Managing Linux and UNIX Servers"
   http://www.puryear-it.com/pubs/linux-unix-best-practices
Identity Management, LDAP, and Linux Integration
Chris Jones wrote:
> I have a client whose internet is running very slowly.  I suspect that 
> there's a lot of traffic coming from somewhere, so I need to sniff the 
> traffic to figure out where it's coming/going.  Problem is, this is a 
> switched network.
>  
> The network is a fairly typical setup, going like this:
> internet -> dsl modem -> cisco pix -> linksys switch -> LAN
>  
> I can't find a way to get this linksys to go promiscuous, so I'm 
> thinking maybe I could set up some kind of machine with two nic's, and 
> have it forward all traffic from one nic to the other, and have the 
> machine just analyze all traffic as it passes through.  Not sure if 
> that's the best route, or maybe one of you guys have run across a better 
> option?  If that is the best way to go, does anyone know of a good free 
> product to do this?  Or maybe I can somehow use SNMP to pull this info 
> out of the pix?  Any suggestions?
___________________
Nolug mailing list
nolug@nolug.org