["Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>]

From: "Dolbow, Bill"
Sent: Friday, April 30, 2004 9:39 PM
Subject: [Ethereal-users] Sniffing in a switched network - Taps or Spans


>
> I am hoping I can get some suggestions on how best to tap/span our
network.
...
> 1. If I tap my aggregation points (firewalls, Content switches, etc)
> can ethereal on RedHat ES3.0 able to combine the transmit and receive
feeds
> into one capture?

Not with Ethereal   but the tool  MERGECAP.EXE in the ethereal distribution
will do this for you.
Take two captures and merge them afterwards.
Or on Linux,  capture on the ALL device.  (keep in mind, capturing on ALL on
linux will NOT set
the ifaces in promisc mode, you have to do that yourself using ifconfig)


MERGECAP will as its name suggests, merge two or more captures into one
single capture.
If you capture on multiple hosts for alter merging,
make sure you have a host with good timestamp resolution (==not windows)
and that all hosts are set to exactly the same time (NTP might not be good
enough here)