There is a device on my network connected via ethernet. Seeing as how hubs are hard to find or ridiculously expensive these days, what hardware can I use if I'm interested in sniffing the traffic to/from the device? Do I get a managed switch and enable port mirroring or are there other options out there that I can look at?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10 '17 at 1:45

If you are using a switch, i guess the only passive option to sniff the traffic for/from that machine is configuring port mirroring(on a capable switch) on the interface connected to that device. There is another way, an ACTIVE scenario called MITM, man in the middle, where you need to spoof the device identity for the switch point of wiew, receiving and sendig your own data, and the device data, to de other people.

But i recommend you the first option, the second has some "deep legal stuff", cause you are able to "change" the information sended a received from that device.


As you suggested, it sounds like you should mirror the traffic. You can capture traffic specific to the port where that device is connected. You will need a switch with that capability.


Another option is a network tap. See that section for some additional information.


You can access and gain visibility of your network traffic using network taps. It's a device that connects directly to the cabling infrastructure to split or copy network traffic to enable mirroring. Ixia's network tap can be a solution for this case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.