Re: Sniffer - Where to install

From: Sam Salhi [MSFT] (samers_at_online.microsoft.com)
Date: 06/02/03 

Date: Sun, 1 Jun 2003 22:13:35 -0700

I thought I gave that away when I specified the edge of the network, but
you're absolutely correct,
If a person wants to sniff some traffic, using the standard NETMON (not the
one that is capable of sniffing entire network traffic) Then the sniffer
should be located on the machine that will either act as a Client or a
server of the service being requested.
With that said, this isn't the case for the SMS version of NETMON, since any
machine on the network with this version will be able to sniff everything
going on the network. 

-- 
===========================================================
This posting is provided "AS IS" with no warranties and confers no rights
===========================================================
"Andy H" <andyh@dev.null> wrote in message
news:Xns938DE82B439D1andydevnull@63.240.76.16...
> Not to debate which sniffer is better but wasn't his original question
> about location of the sniffer?
>
> You must choose wisely on the location.  Think of what traffic do you want
> to sniff - If it's the entire lan then you must plug into a switch that
> will see all traffic you desire.  You will also have to setup some port
> mirroring in the switch to the port that you will connect the sniffer to,
>
> Above being said barring any collection agents and such on the network.
>
> "Sam Salhi [MSFT]" <samers@online.microsoft.com> wrote in
> news:Ohu7SHJKDHA.1608@TK2MSFTNGP11.phx.gbl:
>
> > Actually, it does way more than just that
> > If I list what netmon will do, It will probably take too long but here
> > is the tip of the iceberg
> > get all traffic in or out
> > filter by a specific IP or number of Ip's
> > Filter by a specific protocol or number of protocols (http/smtp/ftp
> > you name it) even unspecified protocols (proprietary)
> > use experts to get correlate related packets
> > programmatically capture specific packets
> > and tons of other features.
> >
> >
>

Relevant Pages

  • Re: sniffing plaintext protocols
    ... You can sniff traffic between two or more hosts if you ... are on the same network. ... you would see all the packets to/from all the ...
    (Pen-Test)
  • Re: Sniffing on switched networks.
    ... zeebop wrote: ... > like ethereal to sniff traffic from other PC's on the same network? ... > hardware I could get to replace the current switch? ...
    (alt.computer.security)
  • Re: WWW-Authenticate error
    ... I tend to get that as a response every time I suggest a network ... and to see what the server sent/received. ... But I have no idea what a network sniff is or how to take one? ... A "client" may be your browser, ...
    (microsoft.public.security)
  • Re: Detecting Sniffers?
    ... Sniff Host A from Host B. Have Ethereal capture on Host ... Since Ettercap poisons the ARP tables, ... > sniffer on the network. ...
    (Security-Basics)
  • RE: Sniffing emails - how?
    ... tunnel back to their systems and sniff data on the remote network. ... |Subject: Re: Sniffing emails - how? ...
    (Security-Basics)