The ability to network sniff is something that is again going to be one of those balancing acts for
us when we are working in an organization.
You're going to want to be able to analyze traffic.
You are going to be looking for security breaches.
You're going to be looking at performance of nodes.
You're going to be sniffing and analyzing packets as part of your responsibilities for maintaining a
wonderful network.
But we don't want this to be done by unauthorized individuals.
A lot of times what you will do is utilize a hardware protocol analyzer.
So notice this isn't going in and setting your neck in promiscuous mode and running something like Wireshark.
Remember we said that's probably going to be against network policy to be done internally on client
workstations.
So instead we show up as an authorized individual with a hardware protocol analyzer.
We plug this into the network.
We start gaining information about the packets very, very quickly.
High performance.
It's often a passive methodology.
No one knows it's taking place, but it's something that we do.
And as you might guess, a hardware, a protocol analyzer is nothing that you would want falling in
the wrong hands.
Something else that we can do is we can do spam ports.
Again, this is something that we want in our tool belt.
We don't want this in the hands of computer criminals, of course.
Let me show you just how easy it is to configure a span port and talk to you about what it is.
So here you can see a packet tracer topology that, yes, you will be working with in a hands on lab
exercise.
That's coming up next.
But anyways, this is a Cisco packet tracer topology that notice has a multilayer switch added.
I needed a little more horsepower in our topology, so I added this multilayer switch.
The reason why I added this multilayer switch is, as you see, I'm going into global configuration
mode and this device is capable of doing what's called span.
And what we do is the monitor command and notice it's the monitor session command in order to configure
one of these span sessions.
What the heck is going on here?
Well, it's called the switch port analyzer or span feature.
And what it does is it can grab frames off of the switch and it can mirror or copy those frames to another
port or even a villain.
In the case of remote span, where you want to be able to capture that the frames and then send them
to some other device in the network, maybe where you have a hardware protocol analyzer connected.
So notice I love to use context sensitive help when I'm setting up something like Span.
And the reason why I do the context sensitive help, honestly, is because there's so many darn Cisco
switches out there that you might encounter.
The syntax will vary slightly from machine to machine, so it's always great to use the context sensitive
help.
Here you can see I'm creating a monitor session.
One is the ID for the session and I could say that I want to grab all of the frames that are coming
in on Fast Ethernet zero slash 16.
And notice I was having some issues with the syntax there.
And the reason why I was was because I stopped using the context sensitive help.
It always does work out great when I take my own advice.
Okay.
So anyways, monitor session one source interface.
How about fast ethernet zero slash 16?
And then watch this.
At the very end, we can specify a direction.
So maybe I want both.
I want ingress and egress frames.
Notice.
That's it.
All we have to do is hit the enter the carriage return.
And we've just set up a span session that's going to take all of the frames coming in and out of fast
Ethernet zero slash 16 and it's going to mirror them.
Now, where is it going to mirror them to?
Well, that's what you do with a monitor session.
One command, and this time we'll say destination.
Maybe I'll go ahead and dump them out to the fastest or net zero slash 15 port.
So there you have it.
Just a great feature enabling you to copy frames from one interface to another.
This is great because remember when we plug in an analyzer by default, it's not going to be hearing.
Frames from certain conversations.
That's how a switch works.
It's going to be restricting the amount of frames that are copied.
Now keep in mind, there is also wire tapping.
Now, when you hear wire tapping, it is often a reference to a hardware protocol analyzer.
So the individual is been hired to go ahead and do the wiretapping in our organization.
And they do use a hardware protocol analyzer.
And it's very passive typically.
But there are wire taps that can tap in and actively not only grab traffic, but manipulate traffic
or maybe even generate traffic into the network in an active fashion.
A lot of times we will have individuals in our network that are operating according to our security
policy, but they are being allowed to sniff traffic.
And we often will refer to this, of course, as lawful interception.