Thursday, January 10, 2008

Configure Cisco Catalyst Switch for Packet Sniffing

If the port you want to monitor is fa0/1 and you would connect the sniffer (Ethereal, Wireshark or Sniffer Pro) to fa0/15 here are the basic commands:

conf terminal
monitor session 1 source interface fa0/1
monitor session 1 destination interface fa0/15

If your switch doesn't support the monitor session syntax, you will need to do the following:

interface FastEthernet0/x
port monitor FastEthernet0/a
port monitor FastEthernet0/b

fa0/x is the port your sniffer is plugged into, 0/a and 0/b would be anyports u want to sniff.

To show monitor session that have configured:
show monitor session local