Mohd Saifullah wrote:
>
> I am trying to classify traffic of a switch by its interface wise. This
> switch allows to monitor other ports by configuring it, i.e., the traffic
> of other interfaces is captured by the monitored port. But the problem is
> each packet is having actual source and destination hw addresses, not the
> interface hw address. So how can i say that this packet has come from this
> interface?
Hi,
You should be able to ascertain this information by examining the
switch's mac address table.
For example, on a Cisco Cat2900 you could issue the following command -
switchy#show mac-address-table
Dynamic Address Count: 6
Secure Address Count: 0
Static Address (User-defined) Count: 0
System Self Address Count: 49
Total MAC addresses: 55
Maximum MAC addresses: 8192
Non-static Address Table:
Destination Address Address Type VLAN Destination Port
------------------- ------------ ---- --------------------
0002.b34b.xxxx Dynamic 2 FastEthernet0/10
0050.dad5.xxxx Dynamic 1 FastEthernet0/24
0050.dade.xxxx Dynamic 1 FastEthernet0/17
0080.c7b1.xxxx Dynamic 1 FastEthernet0/5
0800.208e.xxxx Dynamic 1 FastEthernet0/1
0800.208e.xxxx Dynamic 2 FastEthernet0/9
How you enumerate this information will depend on the make/model of you
switch.
Cheers,
Mike.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
