WEBVTT 00:00.870 --> 00:07.770 The ability to network sniff is something that is again going to be one of those balancing acts for 00:07.770 --> 00:10.740 us when we are working in an organization. 00:11.100 --> 00:14.730 You're going to want to be able to analyze traffic. 00:14.940 --> 00:18.100 You are going to be looking for security breaches. 00:18.300 --> 00:21.690 You're going to be looking at performance of nodes. 00:21.870 --> 00:29.670 You're going to be sniffing and analyzing packets as part of your responsibilities for maintaining a 00:29.670 --> 00:30.840 wonderful network. 00:31.140 --> 00:35.550 But we don't want this to be done by unauthorized individuals. 00:36.030 --> 00:41.130 A lot of times what you will do is utilize a hardware protocol analyzer. 00:41.520 --> 00:48.840 So notice this isn't going in and setting your neck in promiscuous mode and running something like Wireshark. 00:49.110 --> 00:55.830 Remember we said that's probably going to be against network policy to be done internally on client 00:55.830 --> 00:56.670 workstations. 00:56.940 --> 01:03.240 So instead we show up as an authorized individual with a hardware protocol analyzer. 01:03.510 --> 01:05.490 We plug this into the network. 01:05.670 --> 01:09.990 We start gaining information about the packets very, very quickly. 01:10.260 --> 01:11.310 High performance. 01:11.550 --> 01:13.950 It's often a passive methodology. 01:14.040 --> 01:17.460 No one knows it's taking place, but it's something that we do. 01:17.550 --> 01:22.800 And as you might guess, a hardware, a protocol analyzer is nothing that you would want falling in 01:22.800 --> 01:23.880 the wrong hands. 01:24.600 --> 01:28.530 Something else that we can do is we can do spam ports. 01:28.800 --> 01:31.860 Again, this is something that we want in our tool belt. 01:32.010 --> 01:35.880 We don't want this in the hands of computer criminals, of course. 01:36.270 --> 01:41.700 Let me show you just how easy it is to configure a span port and talk to you about what it is. 01:42.600 --> 01:49.500 So here you can see a packet tracer topology that, yes, you will be working with in a hands on lab 01:49.500 --> 01:50.160 exercise. 01:50.160 --> 01:51.190 That's coming up next. 01:51.570 --> 01:58.990 But anyways, this is a Cisco packet tracer topology that notice has a multilayer switch added. 01:59.010 --> 02:04.980 I needed a little more horsepower in our topology, so I added this multilayer switch. 02:05.340 --> 02:11.400 The reason why I added this multilayer switch is, as you see, I'm going into global configuration 02:11.400 --> 02:17.280 mode and this device is capable of doing what's called span. 02:17.640 --> 02:25.470 And what we do is the monitor command and notice it's the monitor session command in order to configure 02:25.470 --> 02:27.720 one of these span sessions. 02:27.960 --> 02:29.460 What the heck is going on here? 02:29.730 --> 02:34.140 Well, it's called the switch port analyzer or span feature. 02:34.410 --> 02:42.780 And what it does is it can grab frames off of the switch and it can mirror or copy those frames to another 02:42.780 --> 02:44.910 port or even a villain. 02:44.910 --> 02:51.690 In the case of remote span, where you want to be able to capture that the frames and then send them 02:51.690 --> 02:57.930 to some other device in the network, maybe where you have a hardware protocol analyzer connected. 02:58.380 --> 03:04.980 So notice I love to use context sensitive help when I'm setting up something like Span. 03:05.400 --> 03:12.870 And the reason why I do the context sensitive help, honestly, is because there's so many darn Cisco 03:12.870 --> 03:15.270 switches out there that you might encounter. 03:15.540 --> 03:23.040 The syntax will vary slightly from machine to machine, so it's always great to use the context sensitive 03:23.040 --> 03:23.310 help. 03:23.700 --> 03:26.740 Here you can see I'm creating a monitor session. 03:26.760 --> 03:36.000 One is the ID for the session and I could say that I want to grab all of the frames that are coming 03:36.000 --> 03:40.620 in on Fast Ethernet zero slash 16. 03:40.740 --> 03:45.360 And notice I was having some issues with the syntax there. 03:45.510 --> 03:49.770 And the reason why I was was because I stopped using the context sensitive help. 03:50.340 --> 03:54.300 It always does work out great when I take my own advice. 03:54.630 --> 03:54.990 Okay. 03:54.990 --> 03:58.110 So anyways, monitor session one source interface. 03:58.110 --> 04:01.350 How about fast ethernet zero slash 16? 04:01.350 --> 04:02.580 And then watch this. 04:02.970 --> 04:06.630 At the very end, we can specify a direction. 04:06.900 --> 04:09.210 So maybe I want both. 04:09.210 --> 04:13.110 I want ingress and egress frames. 04:13.350 --> 04:13.890 Notice. 04:13.890 --> 04:14.530 That's it. 04:14.550 --> 04:18.000 All we have to do is hit the enter the carriage return. 04:18.300 --> 04:26.250 And we've just set up a span session that's going to take all of the frames coming in and out of fast 04:26.250 --> 04:29.280 Ethernet zero slash 16 and it's going to mirror them. 04:29.580 --> 04:31.680 Now, where is it going to mirror them to? 04:31.890 --> 04:34.890 Well, that's what you do with a monitor session. 04:34.890 --> 04:38.430 One command, and this time we'll say destination. 04:38.700 --> 04:44.340 Maybe I'll go ahead and dump them out to the fastest or net zero slash 15 port. 04:45.060 --> 04:46.080 So there you have it. 04:46.080 --> 04:52.230 Just a great feature enabling you to copy frames from one interface to another. 04:52.260 --> 05:00.300 This is great because remember when we plug in an analyzer by default, it's not going to be hearing. 05:00.400 --> 05:02.830 Frames from certain conversations. 05:02.860 --> 05:04.160 That's how a switch works. 05:04.180 --> 05:07.810 It's going to be restricting the amount of frames that are copied. 05:08.850 --> 05:13.060 Now keep in mind, there is also wire tapping. 05:13.230 --> 05:18.990 Now, when you hear wire tapping, it is often a reference to a hardware protocol analyzer. 05:19.320 --> 05:25.650 So the individual is been hired to go ahead and do the wiretapping in our organization. 05:25.890 --> 05:28.740 And they do use a hardware protocol analyzer. 05:28.740 --> 05:30.630 And it's very passive typically. 05:30.930 --> 05:38.130 But there are wire taps that can tap in and actively not only grab traffic, but manipulate traffic 05:38.130 --> 05:42.660 or maybe even generate traffic into the network in an active fashion. 05:43.320 --> 05:50.700 A lot of times we will have individuals in our network that are operating according to our security 05:50.700 --> 05:54.270 policy, but they are being allowed to sniff traffic. 05:54.420 --> 05:58.440 And we often will refer to this, of course, as lawful interception.