Hi all,
in my line of work, we need to do a significant amount of network sniffing.
An important tool for sniffing is a L2 hub.
Unfortunately, it is not as easy nowadays to buy true L2 hubs (not switches).
Is it possible to replicate a L2 hub with mikrotik? That is, to bridge multiple interfaces so that all traffic received over one interface is retransmitted on all the others?
Thank you in advance
nemo
If you were sniffing for good purposes you would know the answers. What evil are you planning?
A currently use a very old 10mbps hub. Sometimes I have so many collisions that I manage to sniff only a fraction of the traffic.
I am thinking that with MT, I could have the flexibility of bridging some of the ethernet ports as a hub while using the rest for other purposes.
If hubbing is not possible, then is it possible to mirror whole ports or VLANs onto another port?
regards
nemo
Tools - Packet sniffer?..
I used to catch suspected spammers in the data center by taking a RB532 and bridging two ports for the server to pass traffic through, then feeding the output to a laptop running wireshark on the third port. Grab a little proof from the TCP stream then terminate the customer for TOS violation.
How did you recognize a spammer, what was in that sniffed stream? Requests to port 25?