[Winpcap-users] hubs vs. switches and promiscuous mode

[Guy Harris]

On Oct 5, 2005, at 3:05 PM, Julie Schultz wrote:

> If you put any nic in promiscuous mode, is there any switch  
> (default configuration) on which you would be able to see all the  
> traffic for all the ports
Some switches support this; see

	http://wiki.ethereal.com/CaptureSetup/Ethernet

for information on doing Ethernet captures; it refers to

	http://wiki.ethereal.com/SwitchReference

which contains information about the feature in question on some  
switches.
> The more I read, the more I see that you cannot sniff ports you are  
> not connected to on a switch unless you change the configuration of  
> it, which is not done simply by putting a nic into promiscuous mode.
Correct - you have to use the "port mirroring" feature of the switch  
(or whatever the vendor calls it); not all switches have that feature.