> Actually, I wonder how many ISP's run their own sniffers. A few ISP's I
> know were recently hacked,
Now now.... no need to scare the normal people.... They already think we
read their email... =)
>
> It got me thinking that maybe I should dedicate a box to network
> sniffing...but now that we have switches that would be a PITA to do a
> complete job. I'm thinking of putting a sniffer on the same switch port
> (via small hub) as our main router.
Just curious... why would you want to do that? Chances are you won't be
running the sniffer 100% of the time... Why not put the code on all your
boxes? That way you need only to sniff a particular segment at a particular
time and you're not overflowing your memory buffers. At first glance this
seems to be inefficient...however, sniffers snif everything. You can fill a
one gig hard drive in a matter of minutes. Breakeing up the job into a
series of parts *might* be a more efficient way of accomplishing your goal...
Rob
Systems Programmer "Open the doors of your stores
rob@fgi.net 24 hours a day"
morgan@springpatch.com Springpatch Mall
http://www.springpatch.com