A key decision for effective packet analysis is where to physically position a packet sniffer to appropriately capture the data. Packet analysts often refer to placing the packet sniffer as sniffing the wire, tapping the network, or tapping into the wire.

Unfortunately, sniffing packets isn’t as simple as plugging a laptop into a network port and capturing traffic. In fact, it’s sometimes more difficult to place a packet sniffer on a network than it is to actually analyze the packets. Sniffer placement is challenging because devices can be connected using a large variety of networking hardware. Figure 2-1 illustrates a typical ...

Get Practical Packet Analysis, 3rd Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.