If this was to be done I'd love it to be done using RMON Packet Capture as
per RFC1757 <http://www.cis.ohio-state.edu/htbin/rfc/rfc1757.html>
This would do two things
1. It would provide an RMON Packet capture daemon/probe that could be
managed by Ethereal or a 3rd-party RMON tool such as Netscout Manager
2. It would allow Ethereal to utilises the packet capture built into some of
the latest switching hardware. For instance the Cabletron SmartSwitch Router
as of firmware version 3.0 now supports all 18 groups of RMON, including
packet capture. This means that instead of what you need to traditional do
in a switch, mirroring traffic to port with a "sniffer" tool, you instead
configure the switch itself to filter and capture packets. These can then be
decoded by an RMON-capable tool such as Ethereal Next-Generation.
(I've reading Stallings on RMON and still haven't quite figured out
everything that needs to be done to write such a manager, but I'm not sure
if I have the skills or bandwidth to take on such a project.
Martin Visser
Technology Consultant - Compaq Services
Compaq Computer Australia
410 Concord Road
Rhodes, Sydney NSW 2138
Australia
Phone: +61-2-9022-5630
Mobile: +61-411-254-513
Fax:+61-2-9022-7001
Email:martin.visser@xxxxxxxxxx