Monitoring Fully Switched Networks

So often we have confusion regarding what happens with packets on a switched network.

Below are some good definitions:

What is a switch:

http://www.pcwebopedia.com/TERM/s/switch.html

In a fully switched network, switches replace all the hubs of an Ethernet network with a dedicated segment for every node. Definition of a segment:

http://www.pcwebopedia.com/TERM/s/segment.html

Every port on a fully switched network is by definition segmented. A great link that explains this is on HowStuffWorks.com:

http://computer.howstuffworks.com/lan-switch5.htm

To understand the information that is contained in the packets on the network such as the device IP adresses, MAC adresses or the protocols requires taping into and capturing information as the packets move across the wire. In a fully switched network managed switches give you that capability by creating monitoring ports that capture the packets from a segmented port and duplicate them to the device monitoring and capturing the packet information.

The following link has a great discussion on how to do this on a Cisco switch. This is referred to as a Span port.

Cisco Link

However, the price of Tap's can get expensive. But today low end managed switches are available that can be purchased for the purpose of creating a monitoring port.

Information on Taps can be found at:

http://www.operativesoft.com/html/taps.htm