Using a Managed Switch as a Network "Tap"

You can use a managed switch as a tap into your network, and let it send packets to a NetFlow or sFlow exporter, which can, in turn, send flow records to a NetFlow or sFlow collector such as InterMapper Flows. (You might want to do this if your switches or routers don't support NetFlow or sFlow natively.)

The trick is that the switch must support "port mirroring" or a "SPAN port" (http://en.wikipedia.org/wiki/SPAN_port). The switch sends copies of packets flowing to/from one port or set of ports to a separate "span" or "mirror" port on the switch, and then to the Flow collector.

Dartware decided to evaluate the Cisco/Linksys SLM2005 Small Business Smart Switch based on a mention in Network World. This inexpensive switch (about $100) supports 10, 100, and Gigabit connections on its five ports. It also supports VLANs, 802.1X port authentication, Power over Ethernet, and more. The only downside that I saw with this switch is that it doesn't support SNMP.

The Web GUI allows you to enable port mirroring (Admin > Port Mirroring) so that the single Target port receives copies of all the packets sent to and from the Source port.

We connected the SLM2005 between our external router/firewall and the backbone switch. We then connected the Target port of the switch to a NetFlow exporter (we used the nProbe software from ntop.org). This was configured to send the flow records into InterMapper Flows.