sniffer behind cisco switch possible?

[aviation88]

Hi there,

I kind of looking/wondering if it`s possible to have a port based VLAN cisco switch with a connection to a sniffer server?? If so, which cisco switch could handle it?

Personally I was thinking of the cisco 2948 G-L3 switch because of IP multicast possiblities but maybe someone can point me to another switch??

[scottmac · Accepted solution]

They will all do "SPAN," which will allow you to copy traffic from a port and send the copy out another port (say, to a "Sniffer" or other analyzer.

In some cases, you can send the copied traffic through the network to another switch and port (I believe this is only available on the 6500 series).

FWIW

Scott

[aviation88]

Hi Scott,

I can`t find it on my switch manual. What does "SPAN" stands for?

[steve · Accepted solution]

SPAN = Switch Port Analizer

Google is really much faster for this question....

http://www.google.com/search?hl=xx-hacker&q=cisco+SPAN&btnG=Google+s3a%7C2ch

http://www.cisco.com/warp/public/473/41.html

[arumugasamy · Accepted solution]

SPAN - SWITCH PORT ANALYZER.

SPAN ports are used to capture the network traffic using sniffers like Cisco IDS,IPS that are connected to the SPAN port in the cisco switch.

Thanks

swamy

[francisaw]

"Switched Port Analyzer" -- it's a very good tool!

Read the following document for an excellent overview and more; Document ID: 10570.

Have a good one!

francis