Colasoft Capsa should be installed on the host/server connected with the switch’s mirror port (span port).

Mirror port configuration:

• Mirror the way out port to the management port (mirror port), in this way the entire data transmitted into/out of LAN can be monitored.
• Mirror all way out ports to the management port (mirror port), in this way not only the entire data transmitted into/out of LAN but also the communication among hosts in LAN can be monitored. (Recommend)

Note: Different brands' switches may apply different mirror port configurations, please refer to the instructions coming with your switch.

The following are two examples for CISCO switch using the "monitor" command in configuration mode:

Format:
#monitor session number source interface mod_number/port_number
#monitor session number destination interface mod_number/port_number

Examples:

• Mirror session 1: mirror port 1-10 to port 12
  #monitor session 1 source interface 1/1-10
  #monitor session 1 destination interface 1/12
   
• Mirror session 2: mirror port 13-20 to port 24
  #monitor session 2 source interface 2/13-20
  #monitor session 2 destination interface 2/24

Change the corresponding parameters when there are multiple mirror sessions or modules.