Practical Packet Analysis

Sniffing in a Routed Environment

All of the techniques for tapping into the wire on a switched network are available on routed networks, as well. The only major consideration when dealing with routed environments is the importance of sniffer placement when you are troubleshooting a problem that spans multiple network segments.

As you learned earlier, a device's broadcast domain extends until it reaches a router. At this point the traffic is handed off to the next upstream router and you lose communication with the packets being transmitted until you receive an acknowledgment of their receipt. In situations like this where data must traverse multiple routers, it is important to analyze the traffic on all sides of the router.

For example, consider ...