LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 09-16-2004, 02:59 AM   #1
kvtournh
Member
 
Registered: Nov 2003
Location: Belgium
Distribution: Mandriva
Posts: 91

Rep: Reputation: 15
Where can I see al the data comming in the network?


Hi,

Maybe this is a stupid noob questions but I was just wondering.

Assume I have a network build up like this.

The backbone of my network comes in a switch, that switch is goes to 6 other switches (1 connection unused) and those 6 other switches go each to 6 or 7 computers. (switches are D-link DES1008).

Is there a way without disconnecting wires that I can see all the trafic comming into the first switch?


thanks

klaas
 
Old 09-16-2004, 04:01 AM   #2
rjlee
Senior Member
 
Registered: Jul 2004
Distribution: Ubuntu 7.04
Posts: 1,994

Rep: Reputation: 76
Yes, you can use an ethernet packet sniffer. Either buy one or convert a Linux box with an ethernet NIC.
 
Old 09-16-2004, 04:13 AM   #3
kvtournh
Member
 
Registered: Nov 2003
Location: Belgium
Distribution: Mandriva
Posts: 91

Original Poster
Rep: Reputation: 15
The point is i want to attach a PC on the net that sees all the traffic. My first idea was to connect it to the first switch on the free port, but since a switch knows where which ip is, it is not possible to do that since by doing the connection i will not see the traffic going to another switch on an other port. So my second idea was atatching a hub just before the first switch but that is impossible since i would have to disconnect the wires and that is not allowed.

Or am I wrong here and does the first switch doesn't remember the IP's because it is connected with the other switches and those do. So the first switch works like a hub? Guess I'm wrong here, but just trying.


Klaas
 
Old 09-16-2004, 09:56 AM   #4
scowles
Member
 
Registered: Sep 2004
Location: Texas, USA
Distribution: Fedora
Posts: 620

Rep: Reputation: 31
Or am I wrong here and does the first switch doesn't remember the IP's because it is connected with the other switches and those do.

I'm assuming these are layer 2 switches you are using. If so, they learn (and switch packets) based on the layer 2 MAC addresses of connected hosts, not the layer 3 IP addresses. For the most part, the ony time a switch will broadcast a packet out all ports is when it has not learned a MAC address or receives a broadcast packet (like ARP's).

So the first switch works like a hub? Guess I'm wrong here, but just trying.

A hub is a layer 1 device. Basically a multi-port repeater. A "typical" switch is a layer 2 device - although switch manufacturers are now offering layer 3 and 4 switches now-a-days.

Since your using a totally switched environment, your goal of seeing "all" traffic on your network is not possible. At least I'm not aware of any way to do this. What is your purpose of trying to see "all" traffic on your LAN? Are you trying to possibly locate a virus infected system?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
can't startx, keeps comming up with an error twistedrhymes Linux - Newbie 2 06-14-2005 10:55 AM
now GUI not comming in Redhat9 TOuseef Linux - General 1 12-09-2004 11:47 PM
Desktop Publishing? Comming soon maybe? Brother Michael Linux - Software 8 04-15-2004 09:35 AM
getting worried: 9.2 is comming twinkers Mandriva 13 09-23-2003 09:06 PM
RedHat 9 is comming!!!!! boreo Linux - General 1 03-24-2003 06:34 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:03 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration