Re: sniffing network traffic, only via a hub or does it matter?



"Dave" wrote:


"markm75" <markm75@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:CE3EF95E-E28A-42FE-9649-56D30D0CC59B@xxxxxxxxxxxxxxxx


"Dave" wrote:


"markm75" <markm75@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A6ACD23E-5FB5-4BA4-A3F9-FFDB9766A5B3@xxxxxxxxxxxxxxxx
I'm trying to trace down some sluggishness in our network and see what
ports
are in use and activity etc.. using Ethereal and other tools..

Is it true.. that the best way is to plug a laptop into a hub (vs a
switch),
which actually would sit outside the firewall.. in between the router
and
the
cable modem (internet)?

Thanks for any info..

well, it depends.... if the external network connection is slow then this
is
the likely place to start. if the internal network is slow then this
won't
help as you need to watch machine to machine traffic on the lan that
won't
show up outside the router.




But does it matter if its a switch or a hub?

In my case we had one user who was causing our internet connection to slow
down to 300ms in ping times.. i was able to trace the problem to them by
putting the laptop in front of the router.. but by the same token.. i
think
the software captures the same data if behind the router and on a switch
(not
sure if a hub is needed or if so why)?


a switch only sends a machine packets that are meant for it, or broadcast
packets meant for the whole network. so if the sniffer is on a switch port
it won't see the other machine's traffic. a hub sends everything to every
port that is connected. so putting a hub between the modem and router is
the only way to monitor internet traffic for all the machines.

it won't let you monitor internal lan traffic between machines or servers on
your lan since the router will keep them inside and not send them to the
internet connection.




I understand this a bit clearer.. but still confused on how apps like
Ethereal are able to capture traffic when i'm running it say on the main
switch (from my desktop) in our LAN.. i can see multiple machine's traffic
and external ports it is using.. like say if someone is using a bitorrent
tool.. those ports appear.. even on the switch..

Or for that matter.. a program like the network monitor with SMS which can
capture all traffic.. that server is on a switch as well...


.

Relevant Pages