9.2 Switches

Switches are Layer 2/3 devices that connect multiple computers together to form a network. Unlike hubs, switches isolate traffic on different switch ports, so that each switch port is a separate collision domain. This prevents Layer 1 interference between stations on different switch ports and improves performance.

9.2.1 Why Investigate Switches?

Switches are typically involved in investigations for one of a few reasons:

• If you are trying to sniff traffic on a local segment, one of the easiest ways is to set up port mirroring on the switch. See Chapter 3, “Evidence Acquisition,” for details.

• Switches contain tables that map client network card addresses (MAC addresses) to physical ports on a switch. This can help you to physically track down a computer.