"Smart" Hubs

[Peter Jeremy]

On Fri, Sep 09, 2005 at 02:44:56PM -0400, Daniel Eischen wrote:
>On Fri, 9 Sep 2005, Brooks Davis wrote:
>> > On Fri, Sep 09, 2005 at 08:39:30AM -0600, Ryan P. Sommers wrote:
>> > > Hub in question is a linksys NH1005 v2.
>> > >
>> > > PS If anyone knows of a hub that's "easy" to find and still is an actuall
>> > > good 'ol hub, let me know.
...
>> Alternativly, if you can get your hands on a second ethernet port for
>> your sniffer box, make a passive tap:
>
>I came in kinda late to this thread, but if you're trying to find
>a hub/switch in order to sniff network traffic, then you can always
>go for a switch that let's you monitor traffic on other ports.
>I know the Cisco's will let you do this, but I'd be suprised if
>you couldn't find it on some other cheaper switches.

I think most managed switches let you do this.  The keyword being
"managed" and a managed switch is always going to be far more
expensive than a hub.  This is mostly useful if you already have
the infrastructure in place and just want to look at one of the
systems attached to the switch.

Note that both hubs and port cloning imply bandwidth limitations: All
the traffic to and from the target system has to be transmited to your
sniffer on a single link.  This limits you to half-duplex speed.

Depending on your requirements, this may or may not be a problem.  If
it is, you are going to be very careful about specifying and
configuring your sniffer box to make sure it can actually handle the
traffic load.

Overall, I also recommend using dual NICs to create a passive tap.

-- 
Peter Jeremy