[wplug] wplug Digest, Vol 63, Issue 9

Mon Jun 15 16:18:05 EDT 2009

Does Pittsburgh get WiMAX?

Sincerely,

James B. Diskin

--------------------------------------------------
From: <wplug-request at wplug.org>
Sent: Friday, May 15, 2009 12:00 PM
To: <wplug at wplug.org>
Subject: wplug Digest, Vol 63, Issue 9

> Send wplug mailing list submissions to
> wplug at wplug.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://www.wplug.org/mailman/listinfo/wplug
> or, via email, send a message with subject or body 'help' to
> wplug-request at wplug.org
>
> You can reach the person managing the list at
> wplug-owner at wplug.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of wplug digest..."
>
>
> Today's Topics:
>
>   1. Tapping into an Ethernet connection (Weber, Lawrence A)
>   2. Re: Tapping into an Ethernet connection (Moshe Hyzon)
>   3. Re: Tapping into an Ethernet connection (Alexandros Papadopoulos)
>   4. Re: Tapping into an Ethernet connection (Brian A. Seklecki)
>   5. Re: Tapping into an Ethernet connection (Max Putas)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 15 May 2009 10:04:16 -0400
> From: "Weber, Lawrence A" <Lawrence.Weber at ansaldo-sts.us>
> Subject: [wplug] Tapping into an Ethernet connection
> To: "General user list" <wplug at wplug.org>
> Message-ID:
> <3D7A5969DC27E747A85F69D1AFF8649509BDF1FF at exchptc2.uss.switch.com>
> Content-Type: text/plain; charset="us-ascii"
>
> I have been trying to tap into an Ethernet connection between two pieces
> of equipment that we have designed.  I have found a cheap hub at only
> one Best Buy that allows me to use WireShark to view the messages.
> However they are only 10Meg Hubs and eventually I am going to need to
> run at 100Meg.
>
> I have two other Linksys hubs (NH1005 and EFAH08W) that are listed as
> "Network Hub" and "Workgroup Hub".  Both of these older (5 yr?) devices
> seem to be switches and not hubs.  I looked on line and can only find
> used 4 port hubs, but I am concerned that they are also just switches.
> Is there any way to know if a hub is a hub and not a switch?  Or, is
> there another way to use WireShark to view traffic?
>
>
> Lawrence. A. Weber
> Consulting Engineer
>
>
>
> Ansaldo STS USA, Inc.
> Union Switch & Signal Building
> 1000 Technology Drive
> Pittsburgh, PA 15219-3120
> USA
> Telephone:  1-412-688-2319
> Telefax:  1-412-688-2398
>
> www.ansaldo-sts.com <http://www.ansaldo-sts.com/>
>
> CONFIDENTIALITY:
> This message is strictly confidential. Its content and use is restricted
> to the designated recipient(s). The use, copy, reproduction or
> transmittal by any process or means without prior written notice of the
> author or Ansaldo STS USA, Inc. office of the Legal Counsel is strictly
> prohibited. If you have received this message in a transmission error,
> please inform the sender immediately and destroy any copy, saved file or
> print you have erroneously made.
>
> PRIVACY:
> Meeting the needs and expectations of our customers and employees has
> always been our highest priority and that includes protecting their
> privacy in compliance with local, state and federal laws and in
> accordance to Ansaldo STS USA, Inc. Privacy Code.
>
> ENVIRONMENTAL NOTE:
> IN SUPPORT OF OUR ENVIRONMENT, WE RECOMMEND NOT PRINTING EMAILS EXCEPT
> WHEN ABSOLUTELY NECESSARY
>
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: 
> http://www.wplug.org/pipermail/wplug/attachments/20090515/f4859c3d/attachment-0001.html
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: not available
> Type: image/jpeg
> Size: 1755 bytes
> Desc: image001.jpg
> Url : 
> http://www.wplug.org/pipermail/wplug/attachments/20090515/f4859c3d/attachment-0001.jpe
>
> ------------------------------
>
> Message: 2
> Date: Fri, 15 May 2009 10:23:05 -0400
> From: Moshe Hyzon <mokatz at gmail.com>
> Subject: Re: [wplug] Tapping into an Ethernet connection
> To: General user list <wplug at wplug.org>
> Message-ID:
> <f34a136f0905150723w9e3345ck72a5641395fff22e at mail.gmail.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> In general, there are no hubs anymore.  Hubs were standard in the 10BaseT
> days, rare in the 100BaseT days and these days are completely incompatible
> with the GigE spec.
> Your best bet is to set up a Linux machine with 2 NICs and bridge them, 
> then
> use wireshark on the bridge interface.  Either that or get an (expensive)
> managed switch that can do port mirroring.
>
> Moshe
>
>
> On Fri, May 15, 2009 at 10:04 AM, Weber, Lawrence A <
> Lawrence.Weber at ansaldo-sts.us> wrote:
>
>>  I have been trying to tap into an Ethernet connection between two pieces
>> of equipment that we have designed.  I have found a cheap hub at only one
>> Best Buy that allows me to use WireShark to view the messages.  However 
>> they
>> are only 10Meg Hubs and eventually I am going to need to run at 100Meg.
>>
>> I have two other Linksys hubs (NH1005 and EFAH08W) that are listed as
>> "Network Hub" and "Workgroup Hub".  Both of these older (5 yr?) devices 
>> seem
>> to be switches and not hubs.  I looked on line and can only find used 4 
>> port
>> hubs, but I am concerned that they are also just switches.  Is there any 
>> way
>> to know if a hub is a hub and not a switch?  Or, is there another way to 
>> use
>> WireShark to view traffic?
>>
>>
>> *Lawrence. A. Weber*
>> Consulting Engineer
>>
>> *[image: image001]**
>>
>> Ansaldo STS USA, Inc.*
>> *Union Switch & Signal Building**
>> 1000 Technology Drive
>> Pittsburgh, PA 15219-3120
>> USA*
>> *Telephone:  1-412-688-2319*
>> *Telefax:  1-412-688-2398
>> **
>> www.ansaldo-sts.com**
>> **
>> CONFIDENTIALITY:**
>> **This message is strictly confidential. Its content and use is 
>> restricted
>> to the designated recipient(s). The use, copy, reproduction or 
>> transmittal
>> by any process or means without prior written notice of the author or** 
>> **Ansaldo
>> STS USA, Inc.** **office of the Legal Counsel is strictly prohibited. If
>> you have received this message in a transmission error, please inform the
>> sender immediately and destroy any copy, saved file or print you have
>> erroneously made.*
>> *
>> PRIVACY:**
>> **Meeting the needs and expectations of our customers and employees has
>> always been our highest priority and that includes protecting their 
>> privacy
>> in compliance with local, state and federal laws and in accordance to
>> Ansaldo STS USA, Inc. Privacy Code.*
>> *
>> ENVIRONMENTAL NOTE:
>> IN SUPPORT OF OUR ENVIRONMENT, WE RECOMMEND NOT PRINTING EMAILS EXCEPT 
>> WHEN
>> ABSOLUTELY NECESSARY*
>>
>>
>> _______________________________________________
>> wplug mailing list
>> wplug at wplug.org
>> http://www.wplug.org/mailman/listinfo/wplug
>>
>>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: 
> http://www.wplug.org/pipermail/wplug/attachments/20090515/b00b8454/attachment-0001.html
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: not available
> Type: image/jpeg
> Size: 1755 bytes
> Desc: not available
> Url : 
> http://www.wplug.org/pipermail/wplug/attachments/20090515/b00b8454/attachment-0001.jpe
>
> ------------------------------
>
> Message: 3
> Date: Fri, 15 May 2009 15:26:34 +0100
> From: Alexandros Papadopoulos <apapadop at alumni.cmu.edu>
> Subject: Re: [wplug] Tapping into an Ethernet connection
> To: General user list <wplug at wplug.org>
> Message-ID:
> <feffd9290905150726i5afb84c1haa0e716fae96f2a2 at mail.gmail.com>
> Content-Type: text/plain; charset=UTF-8
>
> On Fri, May 15, 2009 at 3:04 PM, Weber, Lawrence A
> <Lawrence.Weber at ansaldo-sts.us> wrote:
>> I have been trying to tap into an Ethernet connection between two pieces 
>> of
>> equipment that we have designed.? I have found?a cheap hub at only one 
>> Best
>> Buy?that allows me to use WireShark to view the?messages.? However they 
>> are
>> only 10Meg Hubs and eventually I am going to need to run at 100Meg.
>
> Ensure your capturing device (PC?) can handle 100Mbit of traffic via
> wireshark. It's a LOT of processing...
>
>> I have two other Linksys hubs (NH1005 and EFAH08W) that are listed as
>> "Network Hub" and "Workgroup Hub".? Both of these older (5 yr?) devices 
>> seem
>> to be switches and not hubs.
>
> Hrmf, Google insists they're hubs... you are running the capturing
> device in promiscuous mode, right?
>
>>? I looked on line and can only find used 4 port
>> hubs, but I am concerned that they are also just switches.? Is there any 
>> way
>> to know if a hub is a hub and not a switch?? Or, is there another way to 
>> use
>> WireShark to view traffic?
>
> I think resorting to cache poisoning to force a switch to act as a hub
> is overkill for what you're trying to do. Go to amazon.com and search
> for "3com hub" or "linksys hub" and you should find a lot of
> inexpensive options.
>
> -A
>
>
> ------------------------------
>
> Message: 4
> Date: Fri, 15 May 2009 10:37:35 -0400
> From: "Brian A. Seklecki" <lavalamp at spiritual-machines.org>
> Subject: Re: [wplug] Tapping into an Ethernet connection
> To: General user list <wplug at wplug.org>, Weber, Lawrence A
> <Lawrence.Weber at ansaldo-sts.us>
> Message-ID:
> <1242398255.31340.3189.camel at soundwave.ws.pitbpa0.priv.collaborativefusion.com>
>
> Content-Type: text/plain
>
> Since this isn't the 80s:
>
> Just get a $100 Cisco Catalyst of just about any model off of Ebay an
> run:
>
> switch# sh run | include monitor
> monitor session 1 source vlan 11 , 20
> monitor session 1 destination interface Gi0/27
>
> switch# sh monitor session 1
> Session 1
> ---------
> Type : Local Session
> Source VLANs :
> Both : 11,20
> Destination Ports : Gi0/27
> Encapsulation : Native
> Ingress : Disabled
>
> ---------------
>
> Replace the VLAN source with a physical source if you don't need to
> strip VLAN Headers.
>
> I recommend the Cat 3560-24 or Cat 3550-12T series for gig.
>
> ~BAS
>
>
>> Your best bet is to set up a Linux machine with 2 NICs and bridge
>> them, then use wireshark on the bridge interface.  Either that or get
>> an (expensive) managed switch that can do port mirroring.
>>
>>
>> Moshe
>>
>
>>
>
>
>
> ------------------------------
>
> Message: 5
> Date: Fri, 15 May 2009 11:24:52 -0400
> From: Max Putas <maxblaze at gmail.com>
> Subject: Re: [wplug] Tapping into an Ethernet connection
> To: General user list <wplug at wplug.org>
> Message-ID:
> <30299c4f0905150824i64929652p2dba8c3e10b52838 at mail.gmail.com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> Lawrence,
>
> On Fri, May 15, 2009 at 10:37 AM, Brian A. Seklecki
> <lavalamp at spiritual-machines.org> wrote:
>> Since this isn't the 80s:
>>
>> Just get a $100 Cisco Catalyst of just about any model off of Ebay an
>> run:
>>
>> switch# sh run | include monitor
>> monitor session 1 source vlan 11 , 20
>> monitor session 1 destination interface Gi0/27
>>
>> switch# sh monitor session 1
>> Session 1
>> ---------
>> Type : Local Session
>> Source VLANs :
>> Both : 11,20
>> Destination Ports : Gi0/27
>> Encapsulation : Native
>> Ingress : Disabled
>>
>> ---------------
>>
>> Replace the VLAN source with a physical source if you don't need to
>> strip VLAN Headers.
>>
>> I recommend the Cat 3560-24 or Cat 3550-12T series for gig.
>>
>> ~BAS
>>
>>
>>> Your best bet is to set up a Linux machine with 2 NICs and bridge
>>> them, then use wireshark on the bridge interface. ?Either that or get
>>> an (expensive) managed switch that can do port mirroring.
>>>
>>>
>>> Moshe
>
> Another option would be to make your own receive only Ethernet tap.
> These links will prove useful:
>
> http://www.ossmann.com/5-in-1.html
>
> http://www.dgonzalez.net/pub/roc/
>
> -- 
> Thanks,
>
> Max Putas
>
>
> ------------------------------
>
> _______________________________________________
> wplug mailing list
> wplug at wplug.org
> http://www.wplug.org/mailman/listinfo/wplug
>
>
> End of wplug Digest, Vol 63, Issue 9
> ************************************ 