If you see only files (messages) to and from your machine while using Give Me Too to capture data or you’re not seeing all the traffic you’re expecting to see from or to the machine you’re trying to monitor, this might be because the interface on which you’re capturing is plugged into a switch. On a switched network, unicast traffic between two ports of a switch will not necessarily appear on other ports — only broadcast and multicast traffic will be sent to all ports. Even if your machine is plugged into a hub, the "hub" may be a switched hub, in which case you’re still on a switched network.

Some switches have the ability to replicate all traffic on all ports to a single port. You can plug Give Me Too into that single port to sniff all traffic. You would have to check the documentation for the switch to see if this is possible and, if so, to see how to do this. Various networking hardware manufacturers name this feature differently:
CISCO - SPAN
3COM - Roving analysis port (RAP)
Intel - Port mirroring

If your switch hasn’t such feature or you can’t use it for some reason, Give Me Too offers you a special tool called Anti-Switch. Use Anti-Switch to intercept traffic in a switched LAN by forging MAC addresses in the ARP caches of computers in your network (ARP-spoofing).

How to use Anti-Switch:

Click the Capture button.

Choose the target network interface (NIC).



Mark the Use Anti-Switch to capture network traffic across switches checkbox.



Click on the Anti-Switch tab that appears.



Specify the IP address of a proxy server or gate that computer in your LAN use to access Internet. If you leave 0.0.0.0 in this field, Give Me Too will try to find out the IP automatically.

Specify the IP range in your LAN Give Me Too must scan or leave the default values.

Click the Scan Network button and wait.
If the scanning is a success, you will see the list of computers that have been found.

Mark the computers Give Me Too will monitor.



Click OK to start capturing data.

Back to top