Editing Network switch (section)

==Traffic monitoring==

It is difficult to monitor traffic that is bridged using a switch because only the sending and receiving ports can see the traffic.

Methods that are specifically designed to allow a network analyst to monitor traffic include:
* [[Port mirroring]]{{snd}} Because the purpose of a switch is to ''not'' forward traffic to network segments where it would be superfluous, a node attached to a switch cannot monitor traffic on other segments. Port mirroring is how this problem is addressed in switched networks: In addition to the usual behavior of forwarding frames only to ports through which they might reach their addressees, the switch forwards frames received through a given ''monitored'' port to a designated ''monitoring'' port, allowing analysis of traffic that would otherwise not be visible through the switch.
* Switch monitoring (SMON) is described by RFC 2613 and is a provision for controlling facilities such as port mirroring.{{ref RFC|2613}}
* [[RMON]]<ref>[http://www.ietf.org/rfc/rfc2819.txt Remote Network Monitoring Management Information Base], RFC 2819, S. Waldbusser, May 2000</ref>
* [[sFlow]]

These monitoring features are rarely present on consumer-grade switches. Other monitoring methods include connecting a layer-1 hub or [[network tap]] between the monitored device and its switch port.<ref>{{cite web |title=How to Build a Miniature Network Monitor Device |date=6 October 2016 |url=https://logrhythm.com/blog/how-to-build-a-miniature-network-monitor-device/ |access-date=2019-01-08}}</ref>