Re: mirroring cable model traffic

["Gleb Paharenko" <gpaharenko () gmail com>]

Hi.

In case you're using HUB, you should. However perhaps it is some delay
with name resolving. Try tcpdump with -n and -l switches.

2008/4/7, Chas Meyer <chas.meyer () gmail com>:
> Just a quick question - I've decided to run snort on all the traffic running
> in and out of my house.  Since my home switch is unmanaged (I can't set up a
> mirror port), I've done it ghetto style.  I set up a hub in between my cable
> modem and my router/switch and plugged the interface on my server that I
> would like to use for sniffing into that hub.  However, when I test this rig
> with tcpdump (using command: sudo tcpdump -vvv -i eth0), all I am getting is
> arp requests on my ISP's network, even with internet use from my local
> network.  Shouldn't I also be seeing all the traffic that is originating and
> terminating at my router/switch?  Any help would be great.  Thanks.


-- 
Best regards.
Gleb Pakharenko.
http://gpaharenko.livejournal.com