Creating a "monitor" port ...

[MichaelDOM2005]

Hello friends -

I've got a rather simple question it seems, and because we have a Cisco router (and people reply to posts in this forum), I'm going to post here in hopes that someone can help me.

We're a small university (200 students; 200 staff), and we're having some REAL issues with P2P stuff. It's causing a major hault in our bandwidth, and we're going to have to do something about it pretty soon.

I downloaded a piece of software called P2P WatchDog. It seems pretty straight-forward, but in order to use it, we're going to have to make some "hard-wire" changes, as the software requires access to ALL packets inbound and outbound.

Here is a brief synopsis of our network:

1. Cisco Router. T1 line from the ISP comes in, and plugs into the LAN port.

2. In the "out" port, a cat5 cable connects to a Cabletron SmartSwitch 2200. There is a fiber link into the 2200 that connects the entire campus network together, and thus, gives the entire campus Internet access.

3. The two residence have Cabletron 6C-105 model switches, all running incredibly outdated versions of firmware (no $ to upgrade).

I originally thought about port forwarding on the switches, but I don't think that mirroring is an option with the firmware that we have (from 1998!), so that's out.

My next plan is to introduce a simple hub into the equation between the Cisco Router and the SmartSwitch 2200. In theory, would this work:

1. I plug a hub into the "out" switch on the router. I plug the Cat5 cable from the 2200 into one port on the hub, and then plug in my computer that is running the P2P Watchdog software.

OR

2. I plug the hub into the LAN port (where the ISP line comes in) and do it that way.

Am I on the right track here? Can I just use an old 10 mb hub, or is that going to seriously slow down internet traffic? I don't know how else to get this software to "see" all of the inbound and outbound packets on our network other than somehow getting it hooked into the router. If this were to work, then maybe my Ethereal software would actually do what it's supposed to!

Please let me know your thoughts on this. I would be grateful!

 

[TravisM]

Option 1 is probably the way to go. Use a 100mb router if you can, as you'll be sure not to see any packet collisions, unless you have > 10 mb link you shouldn't see a slow down even with a 10mb hub, but the chance for collisions/late collisions is higher (it exists) and may interrupt traffic.

There are ways to poison arp and see the packets from the switch, but a hub will do just fine, in all honesty.

 

[dearingkr]

If you've got just a single T-1 circuit, then your internet bandwidth is only 1.544Mb. Introducing a 10Mb hub obviously will not slow your network down.

MCSE CCNA CCDA

 

[patrckb]

Also,

make sure that whereever you connect the hub, that the other end is half-duplex. If it goes into full duplex mode talking to a hub (by nature, a half-duplex device), the collisions WILL seriously slow you down.

Also, make sure you actually have a HUB. A lot of devices on the store shelves these days say "hub" but they are actually switches and won't do what you want.

The last known true hub being sold today is the Netgear DS104 / DS108 line. Does anyone know any others?

HTH,
Patrick

Patrick Bartkus, CCNP, CNX, SCM, RHCE Sr. Network Engineer
GA Dept of Labor IT Network Services
If truth were not absolute, how could there be justice?

 

[MichaelDOM2005]

Hello friends -

I would like to thank everyone for their help and assistance! I introduced the hub yesterday, and plugged our packet sniffer computer into another port on the hub. We can see all of the traffic now, and our P2P software is working as it should.

I appreciate everyone's help very much. Have a great weekend.

Take care,
Michael.

 

[wybnormal]

A more optimal solution is to build your own passive network tap. Unlike a hub, this can protect the sniffer or IDS from being seen on the wire or the sniffer sending packets out onto the wire by mistake. It can also get around that on a full duplex connection, you need to see two pairs in order catch both sides of the conversation. Also, being a completely passive device, no power is needed. Just about 40 dollars and 15 minutes of your time building it up. You can get the instructions from

http://www.snort.org/docs/tap/

Just a thought.

MikeS


Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu