Packet capture made simple

Capturing packets from computer networks can sometimes sound like an activity reserved for hackers and geeks. Looking at a stream of raw packets is not for the fainthearted, but thankfully there are a number of technologies out there that can make the task easier.

Before you can consider packet capture you need to look at how you can implement it on your network. Almost all networks nowadays are based on network switches, no more hubs thankfully. One of the reasons we use network switches is that they are good at only sending packets where they are needed. If I copy some files from a server, my data won't be sent to every network port, which is what happens with hubs. Instead, the switch will send my data though a path that it figures out by communicating with other switches. There are some exceptions to this with broadcast and multicast traffic but normally levels of those types of traffic are low.

Hubs had an advantage over switches when it came to troubleshooting problems. If you connected to one port you saw all traffic on the network, and data was replicated across all ports. In order to keep this useful functionality, switch manufacturers include a feature called port mirroring. Port mirroring allows you to take a copy of the data going to and from one or more ports. This type of feature is sometimes called passive or out-of-band monitoring as it does not impact network operations.