Sniffing on my lan HELP

Hi.

Looking at your diagram, you might have some difficulty in instrumenting a network analysers (be it a freebee like wireshark on a laptop, or something more sophisticated like a netscout infinistream.

You've got two options, SPAN and TAP.

SPANS (sometimes called mirror ports) are types of ports on switches that can send a copy of data on a port to another port for monitoring, most CISCO and HP switches allow this.

TAPS are effectivly the physical equivilent of spans. e.g.
Once you have got instrumented its a case of capturing. You can use wireshark with your NIC set to promiscuous mode to see data, better still look at a network analyser with a disk drive -> the difficulty is often recreating an issue or timing your capture to get the 1/2 second burst that tells you what the problem is. Something like an infinistream will help you do this. These tend to be fairly expensive, but will cut your investigation times significatly.

Final option, you could get some proffessional services, these guys are very good and use netscout hardware to diagnose faults.

Good luck

The OSS Guy

What Cisco switches are you using, is there a spare point on each for SPANning?