can differnet subnet sniffer each packet(broadcast) on defaltu L2 switch ?

[yixuan lin]

Dear Sir:

there are two subnet  192.168.1.x/24 and 192.168.2.x/24 connect from firewall two interface on the defalut Cisco L2 switch (2960X or 2960S...)

Before setting vlan , can the different subnet sniffer each packet(broadcast) via wireshark or other sniffer softwares ? 

thanks!

[pwwiddicombe]

If the sniffer is connected to a port in a vlan, it will see all broadcasts within that vlan, so you should be able to hook up 2 wiresharks units to see traffic on both sides of the firewall; provided you connect to the different vlans.

Note that with no SPAN session set, you will only see broadcast traffic (including mac address flooding), but only the unresolved packets before the syn/ack session is set up.  Normal TCP sessions should be "invisible" or incomplete on the wireshark session captures.

[Prabath Godevithanage]

Hi Yixuan,There are few ways that you could capture packets on Cisco gear. have a look at the link here to get an overall understanding. I see you only required to capture broadcasts so you can do that if you just plugin your wireshark PC in to a port in each vlan.