Port Mirroring for Traffic Analysis
Network Sniffer Connected To Switch
- Challenges arise when connecting a sniffer to a switchport (instead of a hub)
- Unicast traffic heads toward destination mac
- Good for security - a challenge for packet capture
- Managed switches can be configured for port mirroring
- Can copy traffic transmitted, received, both
- Can also copy VLAN traffic
- Anything common from VLAN 50, I want to take a copy and copy it to any destination that you would like for example.
- RSPAN is Remote SPAN
- To copy traffic out of a VLAN
- LSPAN vs RSPAN
- Local Span and Remote SPAN
- Switch port analysis vs. Remote switch port analysis.
/CAP/Network+/Visual%20Aids/Pasted%20image%2020250207153222.png)
- Spanning what happens on Eth4
- Switches are Full Duplex
- You can speak and listed at the same time.
- Gigabith Eth
- The maximum is 2Gbps since it is 1 Gbps per direction (listening and speaking)
- Are we overwhelming our SPAN interface
- TX, RX, Both
- Do not oversubscribe a particular device