2

My intention is to analyze all network traffic which is coming to and originating from a network connected device I have. From the configurations of the device I am able to proxy all the HTTP traffic originating from the device but I believe the device communicates over other protocols too.

The device and my machine both are on a switched network and I do not want to perform ARP cache poisoning to route all the packets through my machine. I am looking for a simpler solution where I would be able to replace the printer with a hub and then connect the printer to one of the ports on the hub. I want to connect my laptop also on one if the ports of this hub I introduced to the network. Technically, the hub would be flooding all the packets to all the ports and I should be able to sniff it from my laptop on promiscuous mode using wireshark.

A problem I identified to this approach was when I started searching for a 'hub'. The search itself gives results for 'switches' which are layer two devices. I am confused regarding the popular usage of the words switches and hubs. What should I buy for this purpose? Should it be a hub or a switch(Technically only a hub can be used for the purpose, but I want to know if the devices listed on websites are actually hubs) ?

hax
  • 3,851
  • 1
  • 16
  • 34

1 Answers1

2

An alternative to purchasing a separate hub is to get a regular consumer router/switch combo and install OpenWRT (or any other firmware with mirroring type functionality).

This will copy all traffic on the router to a specific IP. Attach your laptop to the router and sniff with promiscuous mode.

There's several ways you can do this. You can run tcpdump on the router and stream that to your laptop see here for instructions.

Or you could use the iptables TEE extension

To answer your original question, yes you can use a hub. Most devices sold these days are switches, or even routers with switches built in. You may have better luck looking for a used hub, especially at a second hand store where older devices are common.

Daisetsu
  • 5,110
  • 1
  • 14
  • 24