From owner-freebsd-hackers@FreeBSD.ORG Wed Nov 24 02:05:16 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7D83516A4CE; Wed, 24 Nov 2004 02:05:16 +0000 (GMT) Received: from mail.vicor-nb.com (bigwoop.vicor-nb.com [208.206.78.2]) by mx1.FreeBSD.org (Postfix) with ESMTP id AA88E43D31; Wed, 24 Nov 2004 02:05:15 +0000 (GMT) (envelope-from julian@elischer.org) Received: from elischer.org (julian.vicor-nb.com [208.206.78.97]) by mail.vicor-nb.com (Postfix) with ESMTP id 5FF4B7A424; Tue, 23 Nov 2004 18:05:15 -0800 (PST) Message-ID: <41A3EC5A.1040502@elischer.org> Date: Tue, 23 Nov 2004 18:05:14 -0800 From: Julian Elischer User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.3.1) Gecko/20030516 X-Accept-Language: en, hu MIME-Version: 1.0 To: Daniel Eischen References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-hackers@freebsd.org cc: simon.roberts@earthlink.net Subject: Re: Network monitoring X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Nov 2004 02:05:16 -0000 Daniel Eischen wrote: >On Tue, 23 Nov 2004, Simon Roberts wrote: > > > >>I apologize that this probably isn't the most relevant >>list to ask this on. Suggestions for better lists will >>be welcome. >> >>I'm trying to monitor traffice on a 100BaseT ethernet >>network link. I split the line, put a "hub" in and am >>trying to run tcpdump on a box off the side of the >>hub. >> >>Unfortunately, it turns out the hub isn't a hub, it's >>a "switching hub" (what's not a switch about this? I >>don't get it). Consequently, all I see are arp >>packets, bootp packets, and the odd broadcast. I went >>to a local store to buy a hub, and guess what, they >>sold me another switching hub, so that has to be >>returned :( >> >>So, the question is, can anyone tell me the >>manufacturer and product name of a real (dumb) hub? I >>could use 10baseT instead if necessary, I just need >>something cheap that is a simple repeater. Of course, >>nobody advertizes "our hub really is a totally dumb >>hub, not like those fancy switching hubs the >> >> >>competition sells" ;> >> >> put an extra interface on your machine and turn on bridging.. (either normal or netgraph bridging should work). >You could always go the other way and get a more capable >switch. At least for the Cisco (3500XL series), you >can put a port in mirroring mode so that it sees all >traffic. Sorry, I haven't any advice on real hubs. > > >