-: Another tool we use in the monitoring process
inside of our networks for both security
and network performance is a protocol analyzer.
A protocol analyzer is used to capture
and analyze network traffic.
Now I know we've talked about protocol analyzers
already in this course.
Things like Wireshark, right?
But I wanted to take a moment to cover the concept
of how these connect to your network.
They can be connected in either promiscuous mode,
or non-promiscuous mode.
If they're in promiscuous mode,
that means the network adapter is going to be able to capture
all of the packets on the network
regardless of who the destination MAC address is.
And this is going to alow them to capture
all of the frames that carry that information.
So promiscuous, it doesn't matter if
you're addressing it to me,
I'm still going to collect it and listen to it.
Now, if I'm in non-promiscuous mode,
I'm only going to capture packets that are addressed
directly to myself, the protocol analyzer.
That's the difference with promiscuous
verse non-promiscuous mode.
Now, to capture the most information,
you're going to need to be put into promiscuous mode.
Not all network adapters support this,
so you need to make sure you have one that does.
Now you also need to set up a port on the switch
that is going to allow you to see all that traffic.
Because in the old days of a hub,
all that information was broadcast across every port.
But with switches, everything is going
based on the MAC address to specific ports
based on it's CAM table.
So to be able to get all that data,
you need to be able to set up port mirroring.
Port mirroring is where you have one or more switch ports
that's configured to forward all of their packets
to another port on the switch.
This port is normally called a SPAN port.
And it's being used to do port mirroring
of all the other ports so that
the protocol analyzer can see it.
Now sometimes you don't have ability
to configure the SPAN port yourself.
Because maybe you're an analyst,
but you're not a network administrator.
If that's the case, you can also put in a network tap.
Now when you talk about a network tap,
you have to really understand how a mirrored port works.
When a mirrored port or a SPAN port is being used,
it's using a logical method to replicate the traffic
across all of the other ports on to that SPAN port.
This does put a lot of additional processing requirements
on the switches CPU, though.
And it can slow down your network or cause packets to drop.
If this is a concern,
or you can't configure a SPAN port yourself,
you can use a network tap instead.
Which is a physical device.
A network tap is a physical device
that allows you to intercept the traffic
between two points on the network.
So maybe I want to put a network tap
between the router and the switch
at the boundary of the network.
This is going to allow me to see everything
that's coming in or out of the network that way.
And it puts no additional load
on the router or on the switch.
I basically cut the cable in between,
unplug it between the two devices,
and put my device in between the two,
and I get a copy of all of the data going between them.
That's the idea with a network tap.
Either can be used, either a SPAN port or a network tap
to accomplish the same thing,
but a network tap is going to be much more efficient
because it is a physical device
using the logical capability inside of the switch.