On Fri, 14 Jul 2000, Gilbert Ramirez wrote:
> > I have a 24-port 10/100 switch. I also have a shared hub plugged in 1 port
> > of the switch. the servers and power user are plugged into the switch and
> > the lowly users are plugged into the shared 10Mbit hub.
> >
> > My ethereal maching is plugged into the shared hub. I can still see packet
> > conversations between two machines that are on the switch. If I'm on a
> > hub,
> > how can I see these packets? Is my "switch" not really a switch?
>
> Are the packets really between two machine (that is, unicast packets),
> or are they broadcast packets? If they are broadcast packets, that would
> explain why you see them. (they could be multicast, too, in which
> case you *might* see them).
Out of interest, are you seeing packets for the only two other machines on the
switch, or are there other machines that you aren't seeing traffic for? Are
both machines on the switch, or is one of them on the hub?
> In a decent switch you can configure a port (and perhaps multiple ports?
> I don't know; I don't have a switch) to be a "replicator" port. (I think
> that's the correct terminology") All traffic on all the ports is replicated
> to that port; it's there explicitly for sniffing purposes.
You can also configure VLAN port mirroring on some switches, where particular
VLAN traffic can be mirrored to a port.
Cheers,
Neil
-------------------------------------------------------------------------------
Neil Hunter Tel: +44 (0)113 207 6073
Internet Systems Developer Fax: +44 (0)113 234 6065
Energis Squared Mobile: +44 (0)7787 100 649
http://www.energis-squared.com/
---------------------------------------
This email is confidential and may be privileged. If you are not the named
recipient please notify the sender immediately and do not disclose to
another person or use it and take copies. If you receive this message in
error please call the switchboard on + 44 (0)113 234 5100.
-------------------------------------------------------------------------------
