Monitoring Internet Traffic in Switched Networks
These days, the majority of local networks are switch-based. Unlike a hub, a switch, when it has received a packet from some port, retransmits it only to one port, where the recipient computer is connected to it. Switches maintain a table of MAC addresses and ports associated with each of those addresses (Content Addressable Memory table). When it has received a packet, switch validates the recipient’s MAC address in the table and selects the matching port to route the packet to. Due to this feature, Internet monitoring with LanDetective may be limited – your adapter will accept only packets that are addressed to you explicitly, because the switch would prevent other packets from getting into your network segment. Note that switches were created not for cutting traffic monitoring opportunities but rather for minimizing network load and maximizing its bandwidth. Moreover, there are special managed switches available on the market (and they are widely spread), which on top of their common features have a special one – to simplify the operation of traffic analysis systems and Internet monitoring solutions. Thanks to this capability, a managed switch can be configured in a way that all packets passing through it would be replicated to a certain switch port. Different manufacturers call the function a different name: Port Mirroring, Switched Port Analyzer (SPAN), or Roving Analysis Port (RAP). If you are a happy owner of a managed switch, turn to the specification for your device to find out whether this feature is supported and how you can activate it. In order to start Internet monitoring after the activation of Port Mirroring, you will need to just connect to the specified switch port and use the promiscuous Capture mode in LanDetective.
If you have linksys router then following way you can use
Port Mirroring to get traffic on other switch interface. Linksys Router Port Mirrorning
- Dirty way to capture traffic
If your switch is unmanageable or you don't have access you can connect your
IP Phone directly to your laptop/Desktop and use
Wireless Interface of laptop to connect your wireless router, also you need to configure routing in laptop to pass IP phone traffic through laptop that way you can run
wireshark on your laptop and capture packets.