So in this genius three topology, I'm going to add a device that will allow me to capture traffic,
basically as if I had a monitoring station in my network.
So let's pretend this ubuntu PC is a monitoring device.
I'm not actually going to use that for monitoring.
I'm going to use Jenna three to do it directly.
But let's pretend you were running.
Why shock on the xubuntu pc?
I could, as an example, use a windows pc here rather than ubuntu, but I'm going to simply capture
the traffic this way.
So again, if I start capturing on this link.
Will I see the traffic from the PC to the server?
I'll filter for http here.
Nothing at the moment.
On the client.
I'll refresh this page.
Don't see anything.
Manually type it in.
Don't see anything.
Shut that down.
Open it up again.
Try and connect to the server.
We don't see any http traffic.
On this link.
But what I'm going to do now is span or mirror the port on the switch.
So on switch one going to go into global configuration mode, I'm going to type monitor this is this
goes by different terms it's known as span or monitor or mirroring span is known as switched port analyzer.
We're going to use the term monitor here.
So I'm going to monitor a session.
I'm going to give it a number one.
I'm going to specify the source interface as gigabit.
0/0.
So this interface is going to be the source.
And then I'm going to say Monitor Session one.
Destination interface gigabit gigabyte zero three.
So source interface, destination interface.
The switch is going to copy all traffic from this interface to this interface.
So let's prove that this is the Wireshark capture from gigabit 203 to the Ubuntu host.
In other words over here on the client.
Refresh the page.
Notice I suddenly see a HTTP traffic.
Refresh the page again.
I see more http traffic.
So because I'm spanning the port, I can see the HTTP traffic.
So if I had a monitoring station here, so I was running a Windows computer or some other computer with
Wireshark directly on it.
I would need to span the port like I've done here to be able to see the traffic.
Again network vendors use different terms mirroring monitoring span but notice show monitor session
and let's say session one.
You can see that we are capturing traffic in both directions on this port and the destination port is
gigabit zero three.
Encapsulation is native.
We're not adding any additional frames to the captures.
So you'll actually see the original frame share notice source Mac address PC going to the server source
IP address of PC to the server as a frame packet segment, random port number going to port 80 and you
can see the actual request made there.
So if we look at the server response, we can see, for instance, the.
PNG file.
Notice nothing was modified.
So.
With a browser.
It often caches the data locally, so it doesn't re request all the data.
To save on bandwidth.
But if I shut that browser down, open it up again and go to the server and I'll go right down.
Again, we see not modified.
So let's actually do this.
I'm going to open up a private window and go to the server.
That way, to force it to do everything again.
So here we go.
Client request.
Here's the reply from the server.
I notice you can see all the data from the server, so you can see title of the web page.
You can see the actual text in the web page.
So.
In summary, be careful of where you capture traffic.
In this example, we wouldn't see the traffic on this link or on this link unless we enabled port monitoring
or span the port.
In other words, you need to get the switch to copy frames from this interface out of this interface.
It wouldn't normally do that if traffic was going from the client to the server.
You have to enable the mirroring of traffic to be able to see it on a switch with a hub.
You wouldn't have to do that.
A hub floods traffic out of all ports, but a switch doesn't.
So once again, don't forget, you need to be careful where you monitoring traffic if you want to see
what's going on.
As an example, if you want to see what's going on on this side of the network, you want to put a probe
or some device on that part of the network so that you can see what's going on.
You could implement remote span where you copy traffic through a tunnel from one side of the network
to another.
But you need to be careful with that because of overhead and because of the amount of traffic that you're
going to be receiving.
So we'd be better to capture traffic locally if you can.