Sniffing on switched network

[Pierre-Yves BONNETAIN <bonnetain () acm org>]

   Hello you all, and (first of all) a very happy and secure new year. Well,
as secure as possible.

   I am currently working on some "pathologic uses" of one customer's network.
In order to get a proper snapshot of what is happening on this network, I need
to sniff packets.
   He is using 3Com Superstack switches (3300 and 1100), stacked into a single
switch through back-panel cables. I am used to HP switches, and those have one
interesting feature to duplicate all trafic going through the switch, whatever 
the port it comes from, to a specific port (where I can hook up my analyzer).
   As far as the Suparstack are concerned, it seems it can only to this for
one port (and not for all ports of the switch), and the "monitored" port and
the "analyzing" one must be on the same physical switch.
   Has anyone of you met this kind of need/switches config ? How did you solve
it (other than changing switches to hub, which could be done in a last resort
but I would prefer not to touch the physical components if possible) ?
   Thanks,
-- 
-+-+ Pierre-Yves BONNETAIN
     Consultant Internet/Sécurité --- B & A Consultants
     Tel : +33 (0) 563.277.241 - Fax : +33 (0) 563.277.245


_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards