Tag: Networking

There are different ways you can capture Network traffic using Wireshark.
1) Locally on host interface
2) Wire Tapping
3) Port Mirroring or SPAN

1) Simplest way of capturing traffic from local traffic (your own computer).
Just select the interface that you want to monitor and hit RUN. Nothing is simpler.

2) Wire Tapping
Another sneaky way of capturing the traffic is to tap the wire.
Instead of Network devices connected directly to each other, simply put a device in between.
Devices like below will do the job. Connect to this device with your wireshark computer and start capturing.

3) Port Mirroring
Switchport analyzer or SPAN is feature on Cisco switches where you can forward the captured packets from one interface to another for monitoring and analyzing.
Its simple to set up, on the device you want to set up span, configure as per below. in below config, fa0/1 will be the interface we want to capture and the packets will be forwarded to fa0/24. A Wireshark PC will be connected to fa0/24.

#config t
#monitor session 1 source int fa0/1 both
#monitor session 1 destination int fa0/24
#do show monitor

If you want to read more about SPAN, below is a link from Cisco on it.
https://www.cisco.com/assets/sol/sb/Switches_Emulators_v2_3_5_xx/help/250/index.html#page/tesla_250_olh/span_overview.html

The SPAN feature, which is sometimes called port mirroring or port monitoring, selects network traffic for analysis by a network analyzer. The network analyzer can be a Cisco SwitchProbe device or other Remote Monitoring (RMON) probes. Port mirroring is used on a network device to send a copy of network packets, seen on a single device port, multiple device ports, or an entire VLAN, to a network monitoring connection on another port on the device. This is commonly used when monitoring of network traffic, such as for an intrusion-detection system, is required. A network analyzer, connected to the monitoring port, processes the data packets. The device can mirror up to four interfaces per session.A packet, which is received on a network port and assigned to a VLAN that is subject to mirroring, is mirrored to the analyzer port even if the packet was eventually trapped or discarded. Packets sent by the device are mirrored when Transmit (Tx) mirroring is activated.Mirroring does not guarantee that all traffic from the source port(s) is received on the analyzer (destination) port. If more data is sent to the analyzer port than it can support, some data might be lost.