Possibly dumb question...buy why not configure a mirror port on your switch(es) to dump all traffic for specific switch ports the port your packet sniffer is on? A good managed switch is able to do this, though terminology varies from vendor to vendor. Need to justify good managed switches? Demonstrate that a user can plug a network cable into two live network jacks and take down the network. ;-) -- Andrew Zbikowski http://andy.zibnet.us/ Bah-weep-Graaaaagnah wheep mini bon. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mailman.mn-linux.org/pipermail/tclug-list/attachments/20130913/dcd50a14/attachment.html>