A switch comprises a switching module coupled to a plurality of ports. The switching module receives and forwards a plurality of packets through the ports. The switch also comprises a management unit comprising a processor and an agent executable by the processor. The agent causes the processor to monitor each packet received by the switching module and determine whether each such packet contains a predetermined fingerprint. Upon determining that a packet contains the predetermined fingerprint, the processor causes additional information to be included in a copy of the fingerprinted packet and forwarded to a predetermined address. The switching module also forwards the packet containing the predetermined fingerprint, but without the additional information, to an address corresponding to a destination address contained in the packet. A method of programming the switches is also described as well as a management workstation used to program the switches and analyze the fingerprinted packets.