Port Mirroring for Traffic Analysis

Network Sniffer Connected To Switch

• Challenges arise when connecting a sniffer to a switchport (instead of a hub)
• Unicast traffic heads toward destination mac
• Good for security - a challenge for packet capture

Port Mirroring Configured on Switch

• Managed switches can be configured for port mirroring
  • Also known as SPAN
• Can copy traffic transmitted, received, both
• Can also copy VLAN traffic
  • Anything common from VLAN 50, I want to take a copy and copy it to any destination that you would like for example.
  • RSPAN is Remote SPAN
    • To copy traffic out of a VLAN
• LSPAN vs RSPAN
  • Local Span and Remote SPAN
  • Switch port analysis vs. Remote switch port analysis.

• Spanning what happens on Eth4
  • Switches are Full Duplex
    • You can speak and listed at the same time.
    • Gigabith Eth
      • The maximum is 2Gbps since it is 1 Gbps per direction (listening and speaking)
  • Are we overwhelming our SPAN interface
    • TX, RX, Both
    • Do not oversubscribe a particular device