Modern Hubs actually switched?

- G
- gorby
  
  Contact options for registered users
posted
19 years ago

Thu, Nov 11, 2004 1:09 AM

I am trying to capture unicast traffic from host A to host B by using host C to sniff on a Linksys 5-port Hub (the newest Linksys/Cisco version).

However it seems this hub is not acting as a repeater. A promiscuous host C will not detect unicast traffic that is not intended for it.

I've tried various nodes to be the promiscuous host to see if it was a datalink issue, but I get the same results.

Also the hub's activity lights will only blink for the sending and receiving unit when packets are transmitted.

We've seen this on 3 modern devices labeled as hubs.

Has anyone else experienced this with modern "hubs"?

Is it now just cheaper to make all devices switching and then label some as hubs as others as switches?

-Brian

- M
- Michael Roberts
  
  Contact options for registered users
Vote on answer
posted
19 years ago

Thu, Nov 11, 2004 4:00 AM

I have a gripe about this. I spend a lot of time troubleshooting and taking packet captures. When port mirrors and spanned ports do not cut the mustard, I sometimes rely on 100Mb/s shared hubs to inject analyzers in the middle of a dataflow. Without shared hubs, and the ability to mirror ports, I am left with purchasing expensive taps. Good thing most hubs will run forever...

-mike

- W
- William P.N. Smith
  
  Contact options for registered users
Vote on answer
posted
19 years ago

Thu, Nov 11, 2004 4:31 AM

That's been true for at least a year now. You have to look for really old gear that you know is hub-based, usually in the used market (eBay, etc) to find real hubs now-adays.

Indeed. Also, most folks who are buying them don't know the difference. With the exception of this one use, they aren't in a lot of demand, and a managed switch will let you do this (at a significantly higher price...)