Re: [fw-wiz] Sniffing DSL Connection

From: Crispin Cowan (
Date: 09/15/03

  • Next message: Mike Cain: "RE: Router Internet Monitoring [bcc][faked-from]"
    To: Chuck Swiger <>
    Date: Sun, 14 Sep 2003 17:58:44 -0700

    Chuck Swiger wrote:

    > wrote:
    >> DSL Modem ---> Hub ---> Linksys Router ---> Internal Machines
    >> I then put a Linux machine on the hub and ran ethereal. No traffic!
    > Do you have a real IP address from the DSL modem, or does your Linksys
    > do PPPOE? If it's the latter, all of the IP traffic is being
    > encapsulated within PPP-- ethereal should still see the traffic, but
    > trying to match by IP addr will fail.

    Or, your "hub" isn't really a hub. I've encountered a recent phenomena
    where network equipment vendors are selling small devices marked as
    "hubs" that are really switches. For most purposes this doesn't matter,
    and in fact is just a free upgrade. But if you're trying to use the hub
    as a network monitoring tap, you're SOL.

    Test: put the hub on some other network that you *know* is carrying
    normal IP traffic and see if you see anything.


    Crispin Cowan, Ph.D. 
    Chief Scientist, Immunix
    firewall-wizards mailing list

  • Next message: Mike Cain: "RE: Router Internet Monitoring [bcc][faked-from]"