Richard & Guy,
There are two options available for sniffing a switch
1, configuring a port of the switch to be in mirroring mode
2, arp-tricks
The easiest way is to capture packets on a switch is using arp-tricks
which does not require any access to log into the switch.
However: I would be very reluctant in putting instructions on how to sniff a switch
in a users-guide for two reasons:
1, I think everyone which really needs to sniff a switch in his/her job already knows
how to do this either by changing the port configuration or by other means (in the situations where mirroring-ports are not an option).
2, People who do not know how to do it the other way should not do it at all.
Let inexperienced netadmins/users loose with tools for messing up arp-tables and their networks will go down really really quick and really really hard.
If this is going in the users-guide, please consider only describing how to do it by
changning the switch configuration as root/superuser.
best regards
ronnie sahlberg
