Home page logo

basics logo Security Basics mailing list archives

RE: mirroring cable model traffic
From: "Rony Cohen" <Rony.Cohen () t-mobile co uk>
Date: Mon, 14 Apr 2008 09:01:22 +0100

alternatively, you can build your own TAP. have a look there


-----Original Message-----
From: listbounce () securityfocus com
[mailto:listbounce () securityfocus com] On Behalf Of Chas Meyer
Sent: Sunday, April 06, 2008 11:35 PM
To: security-basics () securityfocus com
Subject: mirroring cable model traffic

Just a quick question - I've decided to run snort on all the
traffic running in and out of my house.  Since my home switch 
is unmanaged (I can't set up a mirror port), I've done it 
ghetto style.  I set up a hub in between my cable modem and 
my router/switch and plugged the interface on my server that 
I would like to use for sniffing into that hub.  However, 
when I test this rig with tcpdump (using command: sudo 
tcpdump -vvv -i eth0), all I am getting is arp requests on my 
ISP's network, even with internet use from my local network.  
Shouldn't I also be seeing all the traffic that is 
originating and terminating at my router/switch?  Any help 
would be great.  Thanks.

T-Mobile (UK) Limited
Company Registered Number: 02382161
Registered Office Address: Hatfield Business Park, Hatfield, Hertfordshire, AL10 9BW
Registered in England and Wales
This email (including attachments) is confidential. If you are not the intended recipient, notify the sender 
immediately, delete this email from your system and do not disclose or use for any purpose.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]