Modern Hubs actually switched?

Question

I am trying to capture unicast traffic from host A to host B by using host C to sniff on a Linksys 5-port Hub (the newest Linksys/Cisco version).

However it seems this hub is not acting as a repeater. A promiscuous host C will not detect unicast traffic that is not intended for it.

I've tried various nodes to be the promiscuous host to see if it was a datalink issue, but I get the same results.

Also the hub's activity lights will only blink for the sending and receiving unit when packets are transmitted.

We've seen this on 3 modern devices labeled as hubs.

Has anyone else experienced this with modern "hubs"?

Is it now just cheaper to make all devices switching and then label some as hubs as others as switches?

-Brian

Michael Roberts · Accepted Answer

I have a gripe about this. I spend a lot of time troubleshooting and taking packet captures. When port mirrors and spanned ports do not cut the mustard, I sometimes rely on 100Mb/s shared hubs to inject analyzers in the middle of a dataflow. Without shared hubs, and the ability to mirror ports, I am left with purchasing expensive taps. Good thing most hubs will run forever...

-mike

William P.N. Smith · Answer

That's been true for at least a year now. You have to look for really old gear that you know is hub-based, usually in the used market (eBay, etc) to find real hubs now-adays.

Indeed. Also, most folks who are buying them don't know the difference. With the exception of this one use, they aren't in a lot of demand, and a managed switch will let you do this (at a significantly higher price...)

Modern Hubs actually switched?

Join the Discussion

Didn't find your answer?