sniffing a switch

darthczyz · 07-23-2003, 05:08 PM

i have a question about sniffing a switch. i've been trying to sniff a cisco switch, with little success. i read through the documentation on dsniff, but when i use it, it just sits at the prompt and doesn't record any traffic. i tried arpspoof'ing, but i really wasn't sure what i was doing, besides flooding my switch. has anyone done this, and if so, do you have a really dumbed down guide on how to do it? thanks

dorian33 · 07-23-2003, 05:58 PM

Try ettercap. It's great but I've never checked it with Cisco.

ovf · 07-23-2003, 06:33 PM

The switch should have a port monitor interface configuration command you can use to mirror the traffic on one or more ports to a port with a sniffer connected. What switch are you using?