Fotis Panagiotopoulos wrote:
I am asking for the brand/model number of the one that you are successfully using, to search for a new or used one. As you can image buying lots of switches in the hope that randomly one of them will have this functionality, is not an good idea :)
You don't have to buy randomly, just look for a switch that supports "port mirroring". These should be available from around ~100 EUR or USD...
The more professional tool for monitoring would be an ethernet tap, which has two ports that work like a repeater and forwards both RX sides to a 3rd port (e.g. ETH or USB) to monitor via wireshark.
If you want a cheaper solution, grab two network cards for your PC and build your own passive tap (e.g. like this: http://www.securityforrealpeople.com/2014/09/how-to-build-10-network-tap.html). You'll have to monitor every side on its own (using wireshark), but you can mix 2 pcaps into one later if you prefer. Mixing is done via timestamps, so using 2 same cards (which are NOT USB) should give the best results. (ATTENTION: as this is passive and you attach a 2nd ETH receiver to one cable, using very short cables is recommended - and worked well for me once I tried!)
Simon _______________________________________________ lwip-users mailing list [email protected] https://lists.nongnu.org/mailman/listinfo/lwip-users
