Network Sniffing Tools

re: Network Sniffing Tools

Lukas — Thu, 24 Jun 2004 18:40:00 GMT

Hello,
Is there any way to sniff traffic between two devices where device b does not respond to a ping request or any other request? Keep in mind device b is a embedded board with no OS. I'd like to see what device b is doing during that time. Any help would be greatly appreciated considering I have been troubleshooting this issue for 4 days now.

re: Network Sniffing Tools

Neilcar — Thu, 24 Jun 2004 18:45:00 GMT

Lukas,

The usual approach there is either to do one of several things:

1. Some switches have tcpdump or something similar on them, so you can run the trace on the switch that device B is connected to.

2. If not, the switch will hopefully support a mirroring/port spanning mode which allows you to mirror the port that device B is on & run your sniffer on a machine connected to that mirrored port.

3. Plug device B and a your sniffer into a hub, plug the hub into the switch.

Let me know if that doesn't make sense.

re: Network Sniffing Tools

Neilcar — Thu, 24 Jun 2004 18:55:00 GMT

One other thing...to use this approach, you'll have to use a sniffer that supports promiscuous mode. Neither netcap.exe nor the lite version of Netmon that's included with Windows 2000 Server/Windows Server 2003 will work. You can use the full version of Netmon from SMS or Ethereal with Winpcap.