Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a single switch that routes all our different offices around the country using Meraki VPN. We have a VM on the switch (to the extent it can see all subdomains and different IP addresses in our other offices) running Kali. I'm trying to figure out the best way to pick and choose our networks in which we want to monitor the traffic. I know when monitoring on the corporate network, we can just run an arpspoof and sniff that route and that works fine. But from the main switch, it seems to be a different story.

Any thoughts?

share|improve this question
Running Kali in a corporation on a day-to-day basis? Whew... – Deer Hunter Jun 4 '13 at 18:48
What's the Whew for? – Joseph Jun 4 '13 at 22:52
"Watch"? Watch for what? What do you plan to do with the data? These answers will change what advice we can give. – schroeder Jun 5 '13 at 17:31
Kali is not designed as a secure system and should not be in an 'always-on' condition. Once it gets rooted, you've given the attacker a gold-plated toolbox on your network. – schroeder Jun 5 '13 at 17:33
Odd, portscans show it's all closed down. It's not really in placement as an always on. It was put in place as a VM to monitor as needed. – Joseph Jun 5 '13 at 19:32
up vote 3 down vote accepted

If your switch supports port mirroring, I would definitely go that route.

Port mirroring will essentially duplicate all traffic coming through the switch, and send it to a single port. You would then want to connect a machine to this port and run whichever packet capturing tool (such as Wireshark) for analysis.

I wouldn't want to go with the ARP poisoning route. This can slow down your network and if the machine sending out the spoofed ARP requests were to fail you could bring your entire network to a halt.

share|improve this answer
Yea, arpspoofing didn't work anyway. Looks like this is our main route. – Joseph Jun 5 '13 at 16:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.