I don't what could be special... I did manage to install the SMS version of network monitor and can see the IP traffic as well....
the switch is a 3com 3300 superstack III... I can't see any other IP traffic ( save for broadcasts and other stuff i'm supposed to).. but I see all the IP phone traffic.... it's really bizzare...
and it's all ports on the switch... not just my workstation... No roving analysis port, no monitoring port, tried spanning tree on and off.. strangest thing i've seen.. i'm trying to get in touch with our IP phone guys...
-----Original Message-----
From: Martin Shurbanov [mailto:shurbanm@xxxxxxxxxxxxxxxxxx]
Sent: Thursday, August 29, 2002 1:25 PM
To: Guy Harris
Cc: Shawn Schiebrel; Ethereal-Users@Ethereal. Com (E-mail)
Subject: Re: [Ethereal-users] IP phones and 3Com 3300 switch
You cannot see all traffic by definition on a regular switch port.
you either need to set it to span , put your workstation on an uplink port
or use dsniff's arpspoof utility.
HTH
On Thu, 29 Aug 2002, Guy Harris wrote:
> On Thu, Aug 29, 2002 at 10:27:01AM -0400, Shawn Schiebrel wrote:
> > is there anything that ethereal would do to put the switch port in a mode
> > that would see the traffic?
>
> Not deliberately. Ethereal just uses libpcap/WinPcap to capture
> packets; the standard versions of libpcap just put the network interface
> into promiscuous mode if asked to, they do not do anything to switches
> (they aren't even aware of switches), and the same is true of the
> WinPcap library and driver.
>
> You would probably find that tcpdump/WinDump also see that traffic.
>
> Perhaps there's something special about the switch port into which your
> workstation is plugged.
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users
