How can a sniffer connect to see all traffic?

September 16, 2010

Connect it to SPAN/mirror/monitor port on switch if available.  All traffic to any port on switch also gets copied to the mirror port (which allows sniffer to see all traffic).  If switch is overwhelmed with traffic the packets may be dropped to the mirror.  Also a hub can be used.

ARP poisoning can be used as well (all traffic is routed through sniffer port…. Ex: cain and able).

Network taps can also be used, it is a physical device that taps every line before it is connected to switch.  This solution is the best way to sniff traffic but the most expensive.

Promiscuous mode can be used, in this mode a network card will not drop packets that are intended for other MACs.