I recently did the following:

- switch between my network and the cable router

- one port on the switch is set to "mirror mode"

- hooked up that port to a dedicated ethernet port on one of my boxes

Why do this?

Because if I run a tcpdump on that interface I see ALL of the traffic passing through the switch which includes all outbound and inbound traffic from my devices.

One interesting thing I've already discovered:

My oven sends random unencrypted keepalive messages over regular HTTP (not HTTPS) to an EC2 server.

I'm very curious to see if that changes over time.