Re: [fw-wiz] Sniffing DSL Connection

From: Crispin Cowan (crispin_at_immunix.com)
Date: 09/15/03

  • Next message: Mike Cain: "RE: Router Internet Monitoring [bcc][faked-from]"
    To: Chuck Swiger <chuck@codefab.com>
    Date: Sun, 14 Sep 2003 17:58:44 -0700
    
    

    Chuck Swiger wrote:

    > Jeff_Lopes@groove.net wrote:
    >
    >> DSL Modem ---> Hub ---> Linksys Router ---> Internal Machines
    >>
    >> I then put a Linux machine on the hub and ran ethereal. No traffic!
    >
    > Do you have a real IP address from the DSL modem, or does your Linksys
    > do PPPOE? If it's the latter, all of the IP traffic is being
    > encapsulated within PPP-- ethereal should still see the traffic, but
    > trying to match by IP addr will fail.

    Or, your "hub" isn't really a hub. I've encountered a recent phenomena
    where network equipment vendors are selling small devices marked as
    "hubs" that are really switches. For most purposes this doesn't matter,
    and in fact is just a free upgrade. But if you're trying to use the hub
    as a network monitoring tap, you're SOL.

    Test: put the hub on some other network that you *know* is carrying
    normal IP traffic and see if you see anything.

    Crispin

    -- 
    Crispin Cowan, Ph.D.           http://immunix.com/~crispin/
    Chief Scientist, Immunix       http://immunix.com
                http://www.immunix.com/shop/
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    

  • Next message: Mike Cain: "RE: Router Internet Monitoring [bcc][faked-from]"