At times, you may hear network administrators talk about their networking trouble spots—
when they observe failures in a localized area. They will say a particular area of the Ethernet is
busier than other areas of the Ethernet where there are no problems. All of the packets travel
through all parts of the Ethernet segment. Interconnection devices that do not pass all the
frames from one side of the device to the other form the boundaries of a segment. Bridges,
switches, and routers divide segments from each other, but low-level devices that operate on
one bit at a time, such as repeaters and hubs, do not divide segments from each other. If only
low-level devices separate two parts of the network, both are part of a single segment. All
frames traveling in one part of the segment also travel in the other part.
The broadcast nature of shared media networks affects network performance and reliability so
greatly that networking professionals use a network analyzer, or sniffer, to troubleshoot
problems. A sniffer puts a network interface in promiscuous mode so that the sniffer can
monitor each data packet on the network segment. In the hands of an experienced system
administrator, a sniffer is an invaluable aid in determining why a network is behaving (or
misbehaving) the way it is. With an analyzer, you can determine how much of the traffic is due
to which network protocols, which hosts are the source of most of the traffic, and which hosts
are the destination of most of the traffic. You can also examine data traveling between a
particular pair of hosts and categorize it by protocol and store it for later analysis offline. With
a sufficiently powerful CPU, you can also do the analysis in real time.
Most commercial network sniffers are rather expensive, costing thousands of dollars. When
you examine these closely, you notice that they are nothing more than a portable computer
with an Ethernet card and some special software. The only item that differentiates a sniffer
from an ordinary computer is software. It is also easy to download shareware and freeware
sniffing software from the Internet or various bulletin board systems.
The ease of access to sniffing software is great for network administrators because this type of
software helps them become better network troubleshooters. However, the availability of this
software also means that malicious computer users with access to a network can capture all the
data flowing through the network. The sniffer can capture all the data for a short period of
time or selected portions of the data for a fairly long period of time. Eventually, the malicious
user will run out of space to store the data—the network I use often has 1000 packets per
second flowing on it. Just capturing the first 64 bytes of data from each packet fills up my
system’s local disk space within the hour.