Wireshark packet sniffing question
Hi,
I have been watching your wireshark packet sniffing videos. My question is , what can I do if I don't have a switch with port mirroring? Can I place a hub between my router and connect my laptop running wireshark to it and the router? Will this allow me to capture all the traffic going to the router? If so will this device work
or do you have any recommendation?
Thanks,
Jason
@Jason-Hammer - The device you linked won't work. You are correct in saying that you need an Ethernet hub if the switch doesn't port mirror (an Ethernet switch by design keeps ports from picking up traffic not destined for them). I don't know of an inexpensive switch small enough to carry around, I've just been fortunate that what I've put in place has had that capability.
@David-Beem Thanks for that info. I still see that you can buy a hub on ebay. just like you thought, I was looking for something a little more portable.
You can probably find a 4 port hub for cheap. We've normally found the cheapest ones we can find...but just doing a search on amazon, I'm kinda surprised by the cost of these things now. I guess because they're not making them any more.
I still have one at home and we have one here at ITProTV. The problem like you said is portability, you can find them small but the power wart with them is still big. doesn't make it easy to put into a slim laptop carrier.
Cordially,
Ronnie Wong
Host, ITProTV
Hubs are shared media devices, so operate in half duplex. One of the really big advantages of switches is that they allow full duplex.
There are some inexpensive switches with port mirroring. Search for "port mirroring switch".
Rick,
What you mention is quite correct but usually, you're not going to leave the hub on that port but for the time period you'll be doing some packet capturing. So though it is a bottleneck it's not one forever :)
There are always trade-off regardless of how you do it. For example, you get a switch that supports port mirroring, you still have to configure that port to do it and essentially if you're dedicating that port for port-mirroring you're taking a port out of production. If you're sending a copy of traffic from all other ports into that single port, it will do it but remember that could be a tremendous amount of data through one port and trying to filter out all that data can be quite daunting for the novice.
If you use a hub, you're really limited to only the traffic you're tying up, granted in this thread that is the router port but you are then sending all traffic through that port at half-duplex. There is no way to get around some of these performance hits. But, it's a solid reminder to be careful when doing this stuff and it's appreciated. :+1:
Cordially,
Ronnie Wong
Host, ITProTV
