If you are sniffing a switched lan it is not as clean and dry as just running a sniffer do the nature of switched networks (single broadcast domain, MULTIPLE collision domains). There are 2 things you can do;
1) Use a cisco switch and then you can create a span port to mirror traffic form any port to any port (not sure about how other switches handle that). 2) Get dsniff (not sure if mr song is still withholding his site because of dmca concerns but dnsiff should be available on packet storm). With dnsiff you can play "mac games". Basically you flood the switch with non existent mac address with the idea that it will eventually fail over open (as opposed to closed which means it wont pass anymore traffic). When it fails open it basically becomes just an expensive hub and you are back to a single collision domain and can sniff again. Cheers, Leon -----Original Message----- From: Jacques Chicourel Nunes Vaz - BA [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 25, 2001 1:33 PM To: '[EMAIL PROTECTED]' Subject: Packet Sniffing in a Switched LAN Hi folks, I have a Lan with 200 desktops and I�d like to sniff it. What tool can I use to see all the packets ( going and coming ) ? Any suggestions ? Regards, Jacques
