1

My intention is to analyze all network traffic which is coming to and originating from a network connected device I have. From the configurations of the device I am able to proxy all the HTTP traffic originating from the device but I believe the device communicates over other protocols too.

The device and my machine both are on a switched network and I do not want to perform ARP cache poisoning to route all the packets through my machine. I am looking for a simpler solution where I would be able to replace the printer with a hub and then connect the printer to one of the ports on the hub. I want to connect my laptop also on one if the ports of this hub I introduced to the network. Technically, the hub would be flooding all the packets to all the ports and I should be able to sniff it from my laptop on promiscuous mode using wireshark.

A problem I identified to this approach was when I started searching for a 'hub'. The search itself gives results for 'switches' which are layer two devices. I am confused regarding the popular usage of the words switches and hubs. What should I buy for this purpose? Should it be a hub or a switch(Technically only a hub can be used for the purpose, but I want to know if the devices listed on websites are actually hubs) ?

  • Look for mirroring for switches. Cisco calls it SPAN, RSPAN, and ERSPAN. Other vendors may have something similar. – Ron Maupin Mar 24 at 1:37
  • While "hub" in networking is commonly used to indicate a repeater hub, the word itself just specifies a multi-port network concentrator that could also be a switch ("switching hub") which really is a multi-port MAC bridge. – Zac67 Mar 24 at 8:55
5

Welcome to Network Engineering! While in theory, a hub would do what you want, they are, as you've discovered, an obsolete technology. You'd be hard pressed to find one for sale anymore.

  • That explains it. Any possible alternatives? – hax Mar 24 at 1:24
  • Nothing simple. Enterprise-class switches allow you to mirror traffic from one port to another, but they are not cheap. – Ron Trunk Mar 24 at 1:31
  • Depends on where you get them. There are several "pro-sumer" switches that can mirror as well. (anything with a management interface would be a good starting point.) – Ricky Beam Mar 24 at 1:48
  • time to hit up the used market on ebay. – Peter Green Mar 24 at 4:44
  • @hax Get a USB ethernet adapter. Plug it into your computer. Plug the printer into this adapter. Set up your computer to act as a switch. Your computer will see all the traffic going through itself. – immibis Mar 24 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.