To analyze switch port traffic, you need to mirror your switch port. This is also known as port mirroring or on Cisco Catalyst switches - Catalyst Switched Port Analyzer (SPAN).
On my switch, I mirror my switch port by running the following commands:
monitor session 1 source interface fa2
monitor session 1 destination interface fa6
Once that's done, I take the physical connection that is in fa6 above and plug in into the eth1 interface on my Linux box.
From my Linux box, I can run tcpdump or use tools like ipfm to analyze the traffic.
Leave a comment