Date: Tue, 23 Nov 2004 20:31:41 -0500 (EST) From: Daniel Eischen <deischen@freebsd.org> To: simon.roberts@earthlink.net Cc: freebsd-hackers@freebsd.org Subject: Re: Network monitoring Message-ID: <Pine.GSO.4.43.0411232025480.9521-100000@sea.ntplx.net> In-Reply-To: <20041124012148.9540.qmail@web52701.mail.yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 23 Nov 2004, Simon Roberts wrote: > I apologize that this probably isn't the most relevant > list to ask this on. Suggestions for better lists will > be welcome. > > I'm trying to monitor traffice on a 100BaseT ethernet > network link. I split the line, put a "hub" in and am > trying to run tcpdump on a box off the side of the > hub. > > Unfortunately, it turns out the hub isn't a hub, it's > a "switching hub" (what's not a switch about this? I > don't get it). Consequently, all I see are arp > packets, bootp packets, and the odd broadcast. I went > to a local store to buy a hub, and guess what, they > sold me another switching hub, so that has to be > returned :( > > So, the question is, can anyone tell me the > manufacturer and product name of a real (dumb) hub? I > could use 10baseT instead if necessary, I just need > something cheap that is a simple repeater. Of course, > nobody advertizes "our hub really is a totally dumb > hub, not like those fancy switching hubs the > competition sells" ;> You could always go the other way and get a more capable switch. At least for the Cisco (3500XL series), you can put a port in mirroring mode so that it sees all traffic. Sorry, I haven't any advice on real hubs. -- DE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.GSO.4.43.0411232025480.9521-100000>