0
\$\begingroup\$

I would like to use Wireshark to watch the communication between my device and the server. I basically need an Ethernet hub to deploy the environment of testing. My trouble is that Ethernet hubs are almost deprecated and replaced by Ethernet switches. It's hard to find an Ethernet hub.

So, my question is:

  1. How can I configure an Ethernet switch into a hub? What kind of Ethernet switch can be used?
  2. Is there any other way to deploy the test environment so that I can run Wireshark to watch the communication between my device and the server?
\$\endgroup\$
3
  • 2
    \$\begingroup\$ You need a (managed) switch with the "port mirroring" feature (sometimes called "SPAN port") to be able to send a copy of all network packets from one or more switch ports to a designated port for analysis or monitoring. \$\endgroup\$
    – StarCat
    Sep 1, 2022 at 6:11
  • \$\begingroup\$ this is a common problem. StarCat's solution is what is commonly done nowadays. Managed switches are a little more expensive than standard switches and the usual manufacturers have budget offerings. I use a tp-link TP1500G-10PS which has PoE as well. \$\endgroup\$
    – Kartman
    Sep 1, 2022 at 6:56
  • \$\begingroup\$ Instead of monitoring Ethernet port, how about monitoring wi-fi communication? That is, how can I monitor communication between two devices which connect to the same wi-fi AP? \$\endgroup\$
    – Stan Huang at Taiwan
    Sep 6, 2022 at 9:10

2 Answers 2

Reset to default
2
\$\begingroup\$

There are other ways to do it without a hub.

Port Mirroring Only some switches support this, but will copy all traffic between two ports into another ports, where you can capture it.

Passive TAP There are either products still made for this purpose (perhaps expensive), or you can build your own easily, if 100 Mbps is enough.

enter image description here

It works by connecting each TX pair into two receiver pairs, one is the original recipient port, the other is your TAP port. The same is done in the other direction. Your TAP ports only have the RX pairs wired, so that your capture card never disturbs the original traffic.

Note that since you need to capture communication between the hosts in both directions, the maximum bandwidth needed is doubled. That is also why you have two TAP ports (one per direction) and two network cards are needed for the capture.

\$\endgroup\$
7
  • \$\begingroup\$ Can you confirm this actually works? 10/100 Ethernet is a point to point connection, so splitting the pair would lead to stubs and triple terminating the pair. If that works then the tap interfaces would need special handling as they can't participate in link autonegotiation and would need to detect the speed and lock on to the commd even if they have no way to transmit link negotiation handshakes. \$\endgroup\$
    – Justme
    Sep 1, 2022 at 8:54
  • \$\begingroup\$ @Justme It's been done before! - look up "throwing-star network tap". Note that 10/100 Ethernet is supposed to work up to 100 meters and up to 8 discontinuities (IIRC) so you do have a bunch of signal integrity headroom \$\endgroup\$
    – user253751
    Sep 1, 2022 at 8:56
  • 1
    \$\begingroup\$ Port mirroring is likely to be found on professional, rack-mount switches, not so much on home routers. It certainly won't be found on switches that don't have web interfaces. \$\endgroup\$
    – user253751
    Sep 1, 2022 at 8:57
  • \$\begingroup\$ @user253751 Yes I understand that splitting the signal may not be a problem even if it is a shady hack, but the problem is, how do you configure the network cards to be able to blindly receive data, as effectively to the network card, it can't participate in any way in negotiation? So if you claim it can be done, can you please also explain how you or someone else can achieve it with the equipment you suggest. \$\endgroup\$
    – Justme
    Sep 1, 2022 at 9:15
  • \$\begingroup\$ @Justme You just turn off negotiation, I think. \$\endgroup\$
    – user253751
    Sep 1, 2022 at 9:15
2
\$\begingroup\$

There are some ways you might be able to pass the traffic directly through the computer. This has the advantage that you can not only see the traffic but (with programming work) modify it. Using Linux is recommended for any of these.

  • If your computer has two network ports, you can make your computer be the switch! If you are using Ethernet you can get a second Ethernet card, even a USB one for a low price. If your computer has Wi-Fi and Ethernet, you can use one of each without buying any new hardware. Set up your computer as an Ethernet switch a.k.a. "bridge". Seriously, this is the easiest one and you can even do it on Windows.

  • Assuming the device uses IP to communicate with the server, you can also trick IP into splitting one network into two. Normally you assign addresses in the same subnet to all the devices on the network. If you use two different subnets, IP will treat it like two different networks, and then you can give your computer two different IP addresses (one in each subnet) and packets will get routed through it.

    You do have to somehow get the device into the second subnet, using manual IP address configuration, or by messing around with DHCP. And the server (if it's on the network) or your real router (if it's not) has to know to use your computer as a router to access the second subnet. This last requirement goes away if you also set up your computer as a NAT router.

  • If the device or the server supports VLANs (unlikely) you can do something similar at the Ethernet level by using VLANs. Put the device on one VLAN and the server on another and make your computer act as a router between two VLANs. Now it's a "proper" setup and not a weird hack, and you can also fiddle with Ethernet traffic if that's relevant. If only one supports VLANs, the other one can be on the default VLAN. But, most likely, neither does.

\$\endgroup\$

Not the answer you're looking for? Browse other questions tagged or ask your own question.