Q:

sniffing on a switched LAN

I often find myself in the position of having to sniff on a connection between for example an arm board I am developing on, and another computer on the network, or out of the network.
The easy situation is when I can install a sniffer on the computer talking to the embedded device. When it is not possible, I currently install an old 10Mb/s HUB. However I am afraid my HUB might stop working, and I would like to know some alternative.
Here are the alternatives I could think of :

Buy another HUB. Is that still possible ?
Have some sort of ethernet sniffing bridge, like what they do for USB. I am afraid this kind of device is expensive.
use ARP poisoning.

A:

More expensive switches will offer port mirroring, where they will mirror the traffic of one or more ports to a dedicated monitor port for (among others) problems like yours. 
But I am not sure at what price class features like that are offered. 

A:

Use ettercap and live happy.
See wikipedia for a list of ARP spoofing capable tools

MAC Flooding attack can be tried too, depending on the switch you are attacking. If the switch is exposed to this kind of attack it will act as an HUB once overflowed.

You can of course use an HW approach (much more less flexible IMHO), a very inexpensive switch such as Dell 27xx and 28xx series offer port mirroring feature

A:

A quick-and-dirty solution for sniffing a single device on is to add a second NIC, connect the device to be sniffed to one NIC (using a crossover cable if necessary) and the LAN to another, then bridge the connections and sniff on the bridge interface. Since you're not wedging the machine into a heavy traffic flow (presumably) you won't really slow anything down.
You can do this in Windows w/ the built-in bridging functionality and something like Wireshark. Linux will let you do the same thing. Other OS's mileage may vary-- I haven't tried it anywhere but on Windows and Linux.

