How can a sniffer connect to see all traffic?

Connect it to SPAN/mirror/monitor port on switch if available.  All traffic to any port on switch also gets copied to the mirror port (which allows sniffer to see all traffic).  If switch is overwhelmed with traffic the packets may be dropped to the mirror.  Also a hub can be used.

ARP poisoning can be used as well (all traffic is routed through sniffer port…. Ex: cain and able).

Network taps can also be used, it is a physical device that taps every line before it is connected to switch.  This solution is the best way to sniff traffic but the most expensive.

Promiscuous mode can be used, in this mode a network card will not drop packets that are intended for other MACs.

Leave a Reply

To create code blocks or other preformatted text, indent by four spaces:

    This will be displayed in a monospaced font. The first four 
    spaces will be stripped off, but all other whitespace
    will be preserved.
    Markdown is turned off in code blocks:
     [This is not a link](

To create not a block, but an inline code span, use backticks:

Here is some inline `code`.

For more help see

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>