Conceptually the right answer, but ... YMMV - even some of the US$20 4 port hubs have become switching hubs - I think that it's become a commodity problem - there's one cheap chipset so everyone uses it kind of stuff.
I use an older Linksys EFAH08W 10/100 hub, but it has to be the v1 unit, the v3 is a switching hub! There's also a design @ snort.org for a passive Ethernet tap. http://www.snort.org/docs/tap/ It looks like it should work as well as the ones sold for US$900 (although I hope those devices are more than a few passive wires...). But I haven't tested it. -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Mike > Tremaine > Sent: Tuesday, March 16, 2004 11:06 AM > To: [EMAIL PROTECTED] > Subject: Re: [Ntop] plea for information > > > On Tue, 2004-03-16 at 08:46, Michael Handiboe wrote: > > http://article.gmane.org/gmane.linux.ntop.general/5081 > > > > This is exactly what I needed and I share the same concerns: > > real hubs are getting hard to find ... what does the industry > > expect us to do when we need to sniff our networks!?!?!? > > > > Sometimes the easiest thing to do is buy (beg, steal) a 4 port hub and > plug the uplink port of the switch into it, as well as the ntop box (or > snort, or whatever) and the other end of the connection. > > This will get you all of the traffic that is inbound and outbound (but > not cross traffic on the switch). Plus it is very cheap. 4 port hubs are > generally less then $20. > > That should at least allow you (your boss) to get a better idea of whats > going on and evaluate if it is worth getting a better switch. > > > -- > Mike Tremaine > [EMAIL PROTECTED] > http://www.stellarcore.net > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
