Multi-Tap Network Packet Capturing

From NST Wiki
Revision as of 09:03, 2 July 2008 by Rwh (talk | contribs) (Example Multi-Tap Network Packet Capture Session: Step-By-Step)
Jump to navigationJump to search

Overview

This section will demonstrate the use of Multi-Tap Network Packet Capture with NST. The NST WUI implementation supports simultaneous Packet Capture on up to 4 network interfaces (Quad Tap) per multi-tap capture session. NST uses the Wireshark network protocol analyzer suite for network packet capture. The light-weight network packet capture tool: "dumpcap" is used as the capture engine.

When capturing packets at Gigabit Ethernet rates and one needs total visibility on the link, then a passive tap is required. Net Optics, a global leader in passive monitoring, makes an excellent 10/100/1000BaseT Tap (TP-CU3) for passively allowing access to monitor GigaBit traffic.

Multi-Tap Network Packet Capture: NAT/PAT Traffic

The diagram depicted below shows an example Multi-Tap Capture Setup for monitoring GigaBit traffic across a firewall boundary. We will explore the capturing of packets as they transverse the firewall and undergo both Network and Port Address Translation.

Multi-Tap Network Packet Capture: Traffic Between Gigabit Switches

The diagram displayed below shows an example Dual-Tap Capture Setup for monitoring network traffic between 2 Gigabit switches. In this case a generic notebook computer was used and configured with 3 network interfaces (A built-in Gigabit LAN adapter, a Gigabit LAN adapter PC-Card and a built-in 802.11g/n wireless adapter for secure remote access and control of NST).

Nst dual tap networking.png

Example Multi-Tap Network Packet Capture Session: Step-By-Step

This section will demonstrate a Multi-Tap Network Packet session using 2 network interfaces (eth1 and eth2) as the target capture interfaces. We will concentrate on email traffic (POP and SMTP). It is assumed that the NST probe has sufficient network interface adapters (at least 2 in this case) to perform this capture.

Step: 1 NST WUI Multi-Tap Network Packet Capture Page

Enter the NST WUI Multi-Tap Network Packet Capture page. From the NST WUI Menu go to Networking then Protocol Analysers and then Multi-Tap Network Packet Capture.

Step: 2