Network sniffing tool is a program and/or device that monitors data traveling over a network. Network sniffing tools can be used both for legitimate network management functions and for stealing information off a network.Network Sniffing tools are also called Protocol Analyzer, Packet Analyzer, Sniffer, Network Analyzer etc.
Network operations and maintenance personnel uses network sniffing tools to monitor network traffic, analyze packets, watch network resource utilization, conduct forensic analysis of network security breaches and troubleshoot network problems. Unauthorized network sniffing tools can be extremely dangerous to a network's security because they are virtually impossible to detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker's arsenal.
However, network sniffing tools can not monitor all traffic at any point of a network. In principal, sniffing tool can only capture and then analyze traffic that passing through the wire at which the tool is located, regardless the tool is hardware or software, freeware or priced at thousands of dollars. This article provides guidance regarding where the network sniffing tools should be install in the network to effectively monitor traffic. First of all, Sniffing Tool can be installed on any computer in a LAN. However, you may receive more analyzed data if it is installed on the gateway, as it can then capture packets transmitted between the LAN and other networks.
Below is a brief introduction to the installation of Sniffing Tool under different network environments.
Shared LAN with a Hub
How to install network sniffing tools for effective traffic monitoring - 1
If your LAN is connected through a hub, Sniffing Tool can be installed on any computer with a Windows platform, because this LAN is a share environment and all packets are visible to all computers.
Switched LAN
How to install network sniffing tools for effective traffic monitoring - 2
If your LAN is under a switched network environment, you need a switch with network management functions in order to install Sniffing Tool on any computer connecting to this switch.
Most modern switches support "port mirroring" feature that allows you to configure the switch to redirect the traffic that occurs on some or all ports to a designated monitoring port on the switch. With this feature, you can monitor the entire LAN segment in a switched network environment. Please refer to the documentation that comes with your switch for information on availability of this feature and configuration instructions.
Intranet
How to install network sniffing tools for effective traffic monitoring - 3
If you have several LANs in an Intranet, Sniffing Tool must be installed on every LAN segment.If Sniffing Tool is installed only on one LAN segment, you will not be able to view and analyze the data of other LAN segments.
To be noted, the host with Sniffing Tool installed on must connect to the monitoring port of the Switch to view traffic from multiple ports.
If you only intend to view and analyze the inbound/outbound traffic of the Intranet, it is recommended that you connect the switched network to a Firewall with a Hub and install Sniffing Tool on the terminal server or another workstation which is connected to the Hub (see illustration below). In this case, Sniffing Tool only captures the communication between subnets and external; the packets transmitted among inner hosts of each subnet cannot be captured.
How to install network sniffing tools for effective traffic monitoring - 4