You won't see much of other traffic of you use a switch. That's because the switch forwards frames only towards the destination if it know where the destination is. There are multiple ways to achieve what you want:
1. You can monitor the traffic going through a specific cable by running it through two bridged NICs.
For example, if you have a cable between A and B, you can do the following to monitor traffic through that cable:
- Connect two NICs to some system. These NICs should be used for this purpose only.
- Bridge the two NICs:
Code:
brctl addbr br0
brctl addif br0 eth4
brctl addif br0 eth5
ifconfig br0 up
ifconfig eth4 up
ifconfig eth5 up
- Remove the cable between A and B. Instead, connect A to eth4, and B to eth5.
- Run Wireshark on either eth4 or eth5.
2. Similarly, you can get rid of the switch and instead use some computer as a switch - using one network card for one port, and bridge them all as above. Then capture on br0.
3. Do ARP poisoning to make everything go through some host (try ettercap). Doesn't require extra hardware.
4. Use a hub instead of a switch. A hub broadcasts all traffic to all ports, allowing every system connected to the hub to see all frames.