Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to experiment with monitoring my home network traffic and wondering if a particular solution I have in mind will work. I have a pretty standard setup, Verizon FIOS coming in to my house and going through a Verizon provided router, which in turn routes traffic for several devices (home computer, phones, etc).

I am wondering if I can put a switch "in front" (or more preferrably, "to the side") so that I can then plug in a dedicated machine (like a Pi or old laptop) which in turn runs snort or whatever IDS I want. However, I'm wary of configuring a gateway machine (e.g., Pi as a gateway machine) because I want the simplest solution to unwind if needed, and I want to incur the least risk (i.e., bad configuration).

Basically, I am thinking that a switch will allow me an easy way to sniff incoming/outgoing traffic w/o forcing me to put that IDS in line.

Is there any merit to this and, if so, any particular switch/hub recommendations?

share|improve this question

migrated from Mar 4 '14 at 20:12

This question came from our site for system and network administrators.

up vote 2 down vote accepted

Not really a question for this site as this site is for Professional SysAdmin to get with other Professional SysAdmin.

But I thought I would give you this piece of data:

  • If you use a good old hub, all ports will automatically get all the traffic.
  • If you don't have a good old hub, then you'll need a switch that does port mirror, then you tell it to mirror the packets of all other ports to the port where your pi or laptop or whatever is connected to.

Then you run whatever program you want - snort, wireshark, xplico, tcpdump, etc to record the traffic and analyze it.

share|improve this answer
Thanks, very helpful! – user2013116 Mar 3 '14 at 2:18

Short answer: Yes, you can.

Longer answer: You can, but you need a switch that supports port monitoring. The switch must be inserted between your LAN and the FIOS modem/router, and configured accordingly.

Or, you can also buy a dedicated "network tap](" equipment, which would be simpler to setup. Deploy it similarly.

share|improve this answer

Even your switch support "port mirroring", you still can not mirror wireless traffic because wireless packets go directly to the router.

A simple solution is to setup a windows/linux gateway, and make your wireless router acting as a wireless switch.

Please check:

share|improve this answer

You must log in to answer this question.