Yes, hub -- I'm looking to "tap" an Ethernet line for monitoring, but it seems as though I can only find switches these days.
Yes, I can probably rig something up on a three-phy box, or wade through Cisco's abysmal description of general vs. trunk and how their private VLANs work, but was hoping for a no-brainer US$10-15 solution to capture the traffic.
I guess you already realized that finding a hub nowadays is going to be nearly impossible, even a used one... some alternative ideas that come to my mind:
- I once read about a technique to make a switch behave like a hub, something about sending some packets periodically, but I cannot remember how it worked.
- A managed switch will probably be able to do this, but will be out of your price range.
- A router with two interfaces bridged in software and some elbow grease with ebtables.
- A virtual machine or two.
If you've got access to a Cisco switch you just need to set up a span port, it's really not that hard:
FWIW, my TP-Link TP1500G switch also offers similar functionality, and they're pretty cheap.
Thanks, I'll take a look at that. I've got SG300s, so hopefully not too different!
Edit: Looks like I still need to figure out how to "wire" GE 1 to GE 2, for example, independent of untagged/VLAN so that they are bridged straight-through, rather than being switched, or at least not have any of the "active" VLANs configured on anything but those two ports. The port monitor is "easy", but I'm trying to diagnose some OpenWrt switch problems, so wanted the confidence that it wasn't my monitor that was causing problems or inserting/blocking packets.
Ah, the SG300 series don’t run the full version of IOS, so you’ll need to find the specific documentation for port mirroring for that platform (not the link I posted). They definitely support SPAN/port mirroring, though, so you should be able to figure it out
Maybe TP-Link TL-SG108E: https://www.tp-link.com/us/products/details/cat-5711_TL-SG108E.html
Know anyone with a crimper? Passive ( recive only ) tap all the way....
Assuming the devices are reasonably close.... Works wonders piped into ntop.