Chad V on 16 Dec 2008 11:37:25 -0800

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

[PLUG] setting up a network tap

I'm looking for some ideas on performing a network tap to capture all
or certain traffic on a LAN using Wireshark and time is at a premium.

The LAN is setup like this:

internal network ------ unmanaged switch--------FiOS router-------  internet
internal network ------ unmanaged switch-----------|

I want to be able to grab all the LAN <---> Internet traffic, but
don't want to take over router / firewall duties for the network.  I
think the best idea would be a mirror port on a swtich, but I don't
have access to any managed switches.  My 2nd idea was to plug the
switches, router and linux PC into a hub and run the PC in promiscuous
mode.  I found an old 10 Mbps hub, but no power cord and I don't want
to bottleneck the network connection.  I'm supposed to find out what's
wrong, not cause more problems.

My next idea is to plug the 1 unmanaged switch into the other, then
run a cable to NIC-1 on linux pc, then run cable from NIC-2 to router.
 I believe this qualifies as a bridge.  The server would just be
capturing traffic via wireshark and monitoring bandwidth used per
device with ntop.

PC & VoIP phone network ------------------- unmanaged
switch-----NIC1-----linux pc-----NIC2------FiOS router -------
PC & VoIP phone network ----- unmanaged switch----|

Using google, I found this article on building a transparent bridge
with he ability to monitor traffic and I'll be following it later.

My questions to the group are thus:

1.  Are there any better ways to do it other than what I mentioned?
2.  What software would you use?
3.  I'm pretty sure the 300 MHz, 128 MB ram, 300 GB hard drive system
is good enough to capture 1 business day worth of traffic for a LAN
with 8 PC's and 8 VoIP phones with light usage patterns.  Do you

Thanks for any help!

Philadelphia Linux Users Group         --
Announcements -
General Discussion  --