95.0k views
0 votes
You have a small network of devices connected together using a switch. You want to capture the traffic that is sent from Host A to Host B.

On Host C, you install a packet sniffer that captures network traffic. After running the packet sniffer, you cannot find any captured packets between Host A and Host B.
What should you do?
a- Manually set the MAC address of Host C to the MAC address of Host A.
b- Run the packet sniffer application on Host B.
c- Connect host A and B together on the same switch port through a hub.
d- Configure the default gateway address on hosts A and B with the IP address of Host C.

1 Answer

1 vote

Final answer:

To capture traffic between Host A and Host B on Host C using a packet sniffer, you should use a managed switch with port mirroring. This would send a copy of the traffic to Host C. If such a switch isn't available, a hub can be used, but it's not recommended due to security and performance reasons.

Step-by-step explanation:

If you are unable to capture traffic between Host A and Host B on Host C using a packet sniffer, none of the options given are correct because switches generally send traffic directly from one port to another, rather than broadcasting to all ports as hubs do.

Therefore, host C will not see the traffic if it's not addressed to it. To capture that traffic, the switch must be capable of 'port mirroring' or 'SPAN' (Switched Port Analyzer). This sends a copy of network packets from one switch port to another, where your packet sniffer is located.

Using a hub, as suggested in option c, is not recommended due to security and performance reasons. Hub could lead to collisions and lower network performance, as every packet is sent to every port. However, if you have an old hub, it could indeed be used for the said purpose since a hub would send all network traffic to all ports, allowing Host C to capture the packets between Host A and Host B.

For the packet sniffer to capture the traffic on Host C, you need to:

  1. Use a managed switch that supports port mirroring and configure it accordingly to mirror the traffic from the port connected to Host A or Host B to the port connected to Host C.
  2. If a managed switch is unavailable, and as a last resort due to aforementioned reasons, using an older hub to connect Host A and B would indeed make the traffic visible on all ports, thus allowing the sniffer on Host C to capture the traffic.
User Ryan Davis
by
7.9k points