曝光台 注意防骗
网曝天猫店富美金盛家居专营店坑蒙拐骗欺诈消费者
Switched network
Switch is a network device working on the Data Link Layer of OSI. Switch can learn the physical addresses and
save these addresses in its ARP table. When a packet is sent to switch, switch will check the packet’s destination
address from its ARP table and then send the packet to the corresponding port.
Network with managed switches
Generally all three-layer switches and partial two-layer switches have the ability of network management; the
traffic going through other ports of the switch can be captured from the debugging port (mirror port/span port) on
the core chip. To analyze the traffic going through all ports, Colasoft Capsa should be installed on this debugging
port (mirror port/span port).
The following table presents the advantages and disadvantages of using a switch with mirror port.
Advantage Disadvantage
No additional facility required
No need to change network topology
Occupies a switch port
Possible influence to network transmission
performance when meeting huge traffic
Topology illustration 2:
property of their respective owners. 8 / 8
Network with unmanaged switches
If your switch has no management function, you can:
Install and Uninstall
Network Analyzer
© 2009 Colasoft. All rights reserved. Colasoft®, the Colasoft logo, Capsa® are among the trademarks or registered trademarks of the company in
the United States and/or other countries. All other trademarks are
Connect a tap with the line to be monitored
Taps can be flexibly placed on any line in network. When the requirement for network performance is very high,
you can add a tap to connect your network. The following table presents the advantages and disadvantages of
using a tap.
Advantage Disadvantage
No influence to network transmission
performance
No interference with data stream and raw data
Does not occupy IP address, free from network
attacks
No need to change network topology
High cost
Additional facility (tap) required
Requires dual adapters
Cannot connect Internet
Topology illustration 3:
property of their respective owners. 9 / 9
Connect a hub with the line to be monitored
Working on share mode, hubs are applicable for small networks.
Advantage Disadvantage
Low cost
No need to be configured
No need to change network topology
Additional facility (hub) required
Interference to network transmission performance when
meeting huge traffic
Not applicable for big networks
Topology illustration 4:
Install and Uninstall
Network Analyzer
© 2009 Colasoft. All rights reserved. Colasoft®, the Colasoft logo, Capsa® are among the trademarks or registered trademarks of the company in
the United States and/or other countries. All other trademarks are
Monitoring a network segment
In the case when you only need to monitor the traffic in a network segment (e.g. Finance department, Sales
department, etc.), you can connect the server on which Colasoft Capsa is installed and the network segment with
a exchange facility. The exchange facility can be hub, switch or proxy server.
Topology illustration 5:
Note: Commonly management switches have the function of port mirroring (spanning); however, the port
mirroring configuration of one brand’s switch may differ from others, please refer to the documentation that comes
with your switch for information on the availability of this feature and the configuration instructions.
Switch and port monitoring
Switch is a network exchange facility operating at the data link layer (layer 2) and sometimes the network layer
(layer 3) of the OSI Reference Model. Classified by working protocols, there are two-layer switch, three-layer
switch, four-layer switch and multiple-layer switch. Switch also can be classified into managed switch and
unmanaged switch. Generally, three-layer switch and above has management function (managed switch).
Unlike hubs, switches prevent promiscuous sniffing. In a switched network environment, Colasoft Capsa (or any
other Colasoft Capsa) is limited to capturing broadcast and multicast packets and the traffic sent or received by
the PC on which it is running.
However, most modern switches (management switches) support "port mirroring", which is a feature that allows
you to configure the switch to redirect the traffic that occurs on some or all ports to a designated monitoring port on
the switch. With this feature, you can monitor the entire LAN segment in switched network environment. Please
refer to the documentation coming with your switch for the availability information about this feature and
configuration instructions.
If your switch dose not support "port mirroring", you can install Colasoft Capsa on a workstation connected to the
中国航空网 www.aero.cn
航空翻译 www.aviation.cn
本文链接地址：
航空资料27(19)
