Re: [Nolug] Packet sniffing on switched network

From: David B. John <>
Date: Fri, 01 Feb 2008 12:16:01 -0600
Message-Id: <1201889761.4928.28.camel@isd4>

On Fri, 2008-02-01 at 11:01 -0600, Chris Jones wrote:
> I have a client whose internet is running very slowly. I suspect that
> there's a lot of traffic coming from somewhere, so I need to sniff the
> traffic to figure out where it's coming/going. Problem is, this is a
> switched network.
> The network is a fairly typical setup, going like this:
> internet -> dsl modem -> cisco pix -> linksys switch -> LAN
> I can't find a way to get this linksys to go promiscuous, so I'm
> thinking maybe I could set up some kind of machine with two nic's, and
> have it forward all traffic from one nic to the other, and have the
> machine just analyze all traffic as it passes through. Not sure if
> that's the best route, or maybe one of you guys have run across a
> better option? If that is the best way to go, does anyone know of a
> good free product to do this? Or maybe I can somehow use SNMP to pull
> this info out of the pix? Any suggestions?

Enable pix syslog and run a syslog virtual appliance.

Or like Ray said, get a better switch. Procurve, IMHO

David John

Nolug mailing list
Received on 02/01/08

This archive was generated by hypermail 2.2.0 : 12/19/08 EST