Server&Application Virtulization

Hub Network :Everything goes everywhere in a hub network.

Switch Network would get
1)Broadcast Traffic
2)Multicast Traffic
3)Traffice to and from a specfic MAC address
4)Any Traffic going to or from UNKNOWN MAC address which is very rare.

Since it is not possible to discconect your server and inject hub in a real time network problem we go for SPAN (Swtiched Port Anaylsis)  also called Port Mirroring.Port Mirroring we configure the switch to copy servers traffic to a alyser port


Analyzer Placement :
1)Hub - Switch all network can be captured when analyser is placed at HUB
2)Switch - Switch  use Port mirroing  SPAN a port  and copy all the traffic on that port to anaylzer port.
3)Switch -Router - Switch traffic between switch and router can be traced ,but not both the layer2 traffics on the switch.
-------------------------------------------------
Packet Transmittal :-

TCP  Source port 1024 (can be anything)
     destination port 21

IP protocal  6  (Reolve name to IP)
   source Ip 192.16.1.4
   destination IP 192.11.1.5

Eth  Destination MAC B (Ip to mAC)
     Source MAC      A
     Ether Type : xyx800
---------------------------------------------
Transulate FTP to port number 21
Get Host IP address resultion(Cache,Hosts file,Network)
Local or remote destination (SUbnet mask)
Local Get MAC address (ARP) (Cache or Network)
Remote Lookup route Inforation (Host,Network or Gateway)
Get MAC address (ARP) (Cache,Network)