From owner-freebsd-hackers@FreeBSD.ORG Wed Nov 24 01:31:44 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 819B216A4CE for ; Wed, 24 Nov 2004 01:31:44 +0000 (GMT) Received: from mail.ntplx.net (mail.ntplx.net [204.213.176.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1F90B43D45 for ; Wed, 24 Nov 2004 01:31:44 +0000 (GMT) (envelope-from deischen@freebsd.org) Received: from sea.ntplx.net (sea.ntplx.net [204.213.176.11]) iAO1VfQ2028044; Tue, 23 Nov 2004 20:31:41 -0500 (EST) Date: Tue, 23 Nov 2004 20:31:41 -0500 (EST) From: Daniel Eischen X-X-Sender: eischen@sea.ntplx.net To: simon.roberts@earthlink.net In-Reply-To: <20041124012148.9540.qmail@web52701.mail.yahoo.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Virus-Scanned: by AMaViS and Clam AntiVirus (mail.ntplx.net) cc: freebsd-hackers@freebsd.org Subject: Re: Network monitoring X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Daniel Eischen List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Nov 2004 01:31:44 -0000 On Tue, 23 Nov 2004, Simon Roberts wrote: > I apologize that this probably isn't the most relevant > list to ask this on. Suggestions for better lists will > be welcome. > > I'm trying to monitor traffice on a 100BaseT ethernet > network link. I split the line, put a "hub" in and am > trying to run tcpdump on a box off the side of the > hub. > > Unfortunately, it turns out the hub isn't a hub, it's > a "switching hub" (what's not a switch about this? I > don't get it). Consequently, all I see are arp > packets, bootp packets, and the odd broadcast. I went > to a local store to buy a hub, and guess what, they > sold me another switching hub, so that has to be > returned :( > > So, the question is, can anyone tell me the > manufacturer and product name of a real (dumb) hub? I > could use 10baseT instead if necessary, I just need > something cheap that is a simple repeater. Of course, > nobody advertizes "our hub really is a totally dumb > hub, not like those fancy switching hubs the > competition sells" ;> You could always go the other way and get a more capable switch. At least for the Cisco (3500XL series), you can put a port in mirroring mode so that it sees all traffic. Sorry, I haven't any advice on real hubs. -- DE