Forum Moderators: phranque
We have a program that runs inhouse on a windows XP host. It collects information from all the computers on our inhouse network. It receives a standard post such as
[(your...] server name:port)/cgi-bin/auth.cgi
Is there a program that I can run that will tell me the data that is being sent back and forth? I tried a program called analogX that is a sniffer but it would not give me inhouse traffic only traffic to the internet.
Thanks,
Dennis
This will sniff every packet going past you, whether internet or intranet.
So, if the computer with the sniffer cannot have its switch port set to "promiscuous mode" (to borrow a term), you might not be able to see any traffic other than the traffic the sniffer machine is engaged in.
Disclaimer: I know that I do not know everything. These are my observations and experiences. Your mileage may vary.
Hubs used to re-broadcast anything that came into one port into all the others. So, computer A on port 1 sends an "ACK" to computer H on port 8, which is sent through the hub, the hub takes that data, and replicates it through to ALL of the ports, 2-8. That's why you can see "everything" when you're plugged in to a hub.
Switches work by looking at the destination MAC address. The MAC address can be thought of as the "Hardware" address of the network card. It keeps an internal store of what MAC addresses are plugged into what ports. So imagine Computer A trying to send to computer H again, the switch will look at the incoming frame and say "Ahhh, it's destined for computer H's MAC address, so I won't send it to ports 2-8 as well, but only to port 8."
Kind of a simplified view of everything, but hopefully it'll help you to figure out with you can't see another computer's network traffic even though you're right next to it and so on.
for more complicated topics, look at [sans.org ] and [snort.org ] (the latter I have built myself, and it works like a charm). Also, today many corporate switches come with spanning ports as well.
MM
