Security Basics: RE: Network sniffing on the wire - managed switches

[Burton Strauss III <bstrauss () gmail com>]

That's what mirror mode or span mode (different switch vendors call it
different things) does for you.

Or you need a physical tap (cost about $1K).

-----Burton

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Tom Yarrish
Sent: Friday, December 26, 2008 1:11 PM
To: security-basics () securityfocus com
Subject: Network sniffing on the wire - managed switches

Hey all,
This may come off as somewhat of a newbie question, but it's one I've  
been curious about.

When you are doing any sort of pen testing or sniffing on the wire,  
how do you handle a managed switch scenario.  If you're connected to a  
switch on one port, how can you monitor the traffic on the the other  
ports if you're not in a monitor mode?  I've never understood how you  
can sniff traffic other than the traffic from your machine to a  
destination.

Thanks ahead of time,
Tom