Port Mirroring

Switch is a network exchange facility operating at the data link layer (layer 2) and sometimes the network layer (layer 3) of the OSI Reference Model. Classified by working protocols, there are two-layer switch, three-layer switch, four-layer switch and multiple-layer switch. Switch also can be classified into managed switch and unmanaged switch. Generally, three-layer switch and above has management function (managed switch).

Unlike hubs, switches prevent promiscuous sniffing. In a switched network environment, Colasoft Capsa (or any other packet analyzer) is limited to capturing packets only from the port the machine connected to and broadcast packets and multicast packets.

However, most modern switches (management switches) support port mirroring, which allows users to configure the switch to redirect the traffic that occurs on some or all ports to a designated monitoring port on the switch. With this feature, you can monitor the entire LAN segment in switched network environment. Please refer to the configuration documents shipped with your switch for this feature and configuration instructions.

If your switch does not support port mirroring, you can install Colasoft Capsa on a workstation connected to the same hub as your Internet gateway, or on your Internet gateway (if acceptable), thus you can monitor all network traffic between your intranet and the Internet. Read Installation Environment to know how to deploy Colasoft Capsa.

A list of some managed switches (with port monitoring/spanning) which are commonly used is available on our website, please visit the Switch Management page for references.