On Wed, Sep 20, 2000 at 05:40:48PM +1000, Asghar Hosseini wrote:
> Dear Sir/madam
>
> First forgive me for my poor english. I want to say that Ethereal is very nice monitoring program and was quite easy to install. I have three PCs at home which are mainly use them for my experimentation. I tested Ethereal successfully in my network both in Ethernet and Token Ring enviroments . Anyhow, I borrowed a Cabletron switch from my work and connected to my network. As this switch is Ethernet technology, I made sure that Ethereal is capturing ethernet packets. But when I turn on switch , I do not see any activities in Ethereal window and I know that switch is only working in unicast manner ( If I am not mistaken ). I have refered to Ethereal user's Guide ( by Richard Sharpe ) and found a topic "Capturing in the presence of Switches and Routers", but I could not find any information under this topic.
Switches don't send all packets to all ports, like hubs do. That's why you
don't see other traffic. On a switch you'll see unicast packets directed towards
you, broadcast packets, and multicast packets of any multicast groups you're
a part of.
Some switches can "repeat" all traffic to a particular port; if so, that's
the port you want to plug into in order to sniff.
Read the sniffing FAQ:
http://www.robertgraham.com/pubs/sniffing-faq.html
> My questions are:
>
> 1) Do you know anything about this part of User's Guide which is missing?
> 2) what do I have to do in Ethereal in order to detect the switch initial startup behaviour ( like reading the MAC address of this switch ) ?
I don't understand question #2.
--gilbert
