Date: Tue, 23 Nov 2004 18:05:14 -0800 From: Julian Elischer <julian@elischer.org> To: Daniel Eischen <deischen@freebsd.org> Cc: simon.roberts@earthlink.net Subject: Re: Network monitoring Message-ID: <41A3EC5A.1040502@elischer.org> In-Reply-To: <Pine.GSO.4.43.0411232025480.9521-100000@sea.ntplx.net> References: <Pine.GSO.4.43.0411232025480.9521-100000@sea.ntplx.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Daniel Eischen wrote: >On Tue, 23 Nov 2004, Simon Roberts wrote: > > > >>I apologize that this probably isn't the most relevant >>list to ask this on. Suggestions for better lists will >>be welcome. >> >>I'm trying to monitor traffice on a 100BaseT ethernet >>network link. I split the line, put a "hub" in and am >>trying to run tcpdump on a box off the side of the >>hub. >> >>Unfortunately, it turns out the hub isn't a hub, it's >>a "switching hub" (what's not a switch about this? I >>don't get it). Consequently, all I see are arp >>packets, bootp packets, and the odd broadcast. I went >>to a local store to buy a hub, and guess what, they >>sold me another switching hub, so that has to be >>returned :( >> >>So, the question is, can anyone tell me the >>manufacturer and product name of a real (dumb) hub? I >>could use 10baseT instead if necessary, I just need >>something cheap that is a simple repeater. Of course, >>nobody advertizes "our hub really is a totally dumb >>hub, not like those fancy switching hubs the >> >> >>competition sells" ;> >> >> put an extra interface on your machine and turn on bridging.. (either normal or netgraph bridging should work). >You could always go the other way and get a more capable >switch. At least for the Cisco (3500XL series), you >can put a port in mirroring mode so that it sees all >traffic. Sorry, I haven't any advice on real hubs. > > >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?41A3EC5A.1040502>