Then You need a network without switches. Without the span port, all unicast frames will only be forwarded to their correct destination ports.
Your sniffer will not "see" the traffic. Using RMON/SNMP, its possible to poll some data directly from the switch, such as statistics, etc. I don't know a way to use snmp to tell the switch to "give me all frames for X flow". A way around this is to put a hub between the switch and the device being monitored (host, fw, router). Then plug your "sniffer" into that hub. The hub is a repeater and will get all frames to the sniffer. Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=72373&t=72372 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
