Drop in passthru network monitor

Question

I am looking for something that will allow me to take a computer with 2 NICs, and drop it in between a link of 2 things (router, server, computer, etc) and monitor all the network traffic, bandwidth, etc.

So for example: Internet -> L3 switch -> L1 switch -> monitor -> L1 switch -> Server

I ask because I am trying to diagnose certain problems on our network here at work.

Answer 1

If you have a managed switch you should look into port mirroring/monitoring on your switch and set your network up like this

Internet-----L3 switch------Server
                  | 
                  | (span port)
                  |
            Monitoring server

Then set the internet & server ports up as port monitor sources, and the monitoring server port(s) up as a port monitor destination.

You may find it beneficial to span the internet side and the server side into separate nics since you have two to play with.

This can all be done non disruptively.

Catalyst Switched Port Analyzer (SPAN) Configuration Example

Answer 2

You can use a commercially available network tap (active or passive) or you can "build" your own by inserting a switch that supports port mirroring (SPAN in Cisco parlance) between the devices and configuring the port monitor accordingly, with your monitoring station connected to this switch (this isn't a true network tap but it will accomplish the task).

You could also insert a hub between the devices but you'll either cause the devices connected to the hub to communicate at half-duplex or you'll cause collisions between the two devices. Using a hub would be the least preferred method but in a pinch I've used one in this manner.