9

I've been trying to find a hub, specifically for the packet broadcast characteristic. I'm troubleshooting a NAS behind a NAT router and want to look at the traffic arriving on the wire and this seems the easiest, fastest way.

Regardless--this is not a question about that; that question is here--I've been having difficulty finding just plain hubs. Most everything these days is switches it seems. That made me wonder if perhaps modern switches can be made to broadcast packets like a hub, rendering hubs unnecessary. Can anyone confirm whether that is in fact the case?

Improve this question
2
  • Hubs are not "special devices" to make broadcasting more efficient, they are simply the older technology coming from an age of networks where everything was on a common bus and transmissions could collide. Modern (gbit and above) ethernet networks are designed on a point-to-point electrical connection base, and there are no tx collisions. Everything is packet switched. Thus saying "rendering hubs unnecessary" is quite misleading, since there would be no application for hubs, as there is no wiring between more than two ethernet ports.
    – PlasmaHH
    Apr 1 '14 at 11:29
  • If you're looking to purchase hardware, you should look at a network tap instead.
    – Colin Pickard
    Apr 1 '14 at 12:04
15

No, not entirely (or none I've ever seen), but you can get managed and smart switches to perform Port Mirroring, which will give you all the traffic on the switch on one port.

Some folk believe that you can force certain types of switches to send out all the frames they receive on all ports, using an MAC or ARP flood attack, but I've no experience with that kind of thing. It is a very old vulnerability, and most manufacturers probably have some mitigation in place.

Improve this answer
7
  • Can't you also put all ports in the same VLAN?
    – jww
    Apr 1 '14 at 0:14
  • 5
    VLANS share a broadcast domain, so you will see all the broadcast traffic on the VLAN, but the switch is still a micro-segmented architechure, so it will only send traffic to mac addresses known to be on that port, or broadcasts. you will miss all the unicast traffic from the other ports on the switch.
    – Frank Thomas
    Apr 1 '14 at 0:16
  • That won't allow you to see all of the traffic transiting that VLAN (except broadcast traffic). You still need to perform port mirroring.
    – joeqwerty
    Apr 1 '14 at 0:17
  • A not-as-good alternative to port mirroring might be to turn a [linux based] system with at least 2 network ports into a bridge and sniff the traffic across the bridge.
    – davidgo
    Apr 1 '14 at 0:22
  • @davidgo Yeah, I thought about doing something like that with my Raspberry Pi, but as I thought about how to go about it (and all the parts that I'd have to stop and learn), it quickly spiraled away from "quick and easy". The hub/switch with port mirroring approach seems much better.
    – Allen
    Apr 1 '14 at 0:35
9

I use an old hub for network troubleshooting as well. They're hard to come by these days. There appear to be a few on Amazon and you may find some on ebay as well. Make sure to read the tech specs carefully to make sure you're actually getting a hub, as opposed to a switch.

http://www.amazon.com/s/ref=sr_nr_n_2?rh=n%3A281413%2Ck%3Anetwork+hub&keywords=network+hub&ie=UTF8&qid=1396311331&rnid=2941120011

A point of clarification: A hub does not broadcast Ethernet frames to all ports (except for broadcast traffic). A hub floods Ethernet frames to all ports. There's a distinct difference between a unicast frame intended for a single host being flooded to all ports and a broadcast frame meant for all hosts being broadcasted to all ports.

Also, there are two types of broadcasts:

  1. Layer 2 broadcasts which are meant for all hosts on the same physical segment.

  2. Layer 3 broadcasts which are meant for all hosts in the same layer 3 network (network/subnet).

As a final note, multicast traffic often behaves like broadcast traffic in that it is flooded to all ports and hosts interested in that traffic can choose to accept it and those not interested discard it.

Improve this answer
4
  • This answer needlessly complicates the issue by bringing up distinctions (flood vs. broadcast, layer 3 vs. layer 2 broadcasts) that are meaningless to this discussion.
    – Spiff
    Apr 1 '14 at 1:00
  • 2
    I didn't consider the content of my answer to be needless. The OP mentioned the packet broadcast characteristic of hubs and I saw the need to clarify the difference between broadcasting and flooding. I wouldn't think that an answer that provides additional information and clarification would be down voted for such, but it is what it is.
    – joeqwerty
    Apr 1 '14 at 1:08
  • 1
    In addition, the distinctions I mention in my answer may well help the OP identify the issue he's troubleshooting by understanding the difference between broadcasting, flooding and multicasting as well as the distinction between a layer 2 and a layer 3 broadcast. At any rate, I have no issue with the down vote, I simply wanted to explain my motivation for providing the answer I did.
    – joeqwerty
    Apr 1 '14 at 1:25
  • @joeqwerty I side with you on this one. Reading between the lines the poster of this question seems to need some additional education in the subject matter.
    – Tonny
    Apr 1 '14 at 20:12
6

First, Gigabit Ethernet doesn't allows hubs. When the IEEE first defined GigE, they briefly had a spec for how a GigE hub should work, but no one ever shipped one, and the IEEE quickly deprecated the spec and recommended that GigE always be switched. (Trivia note: This means that GigE is technically not CSMA/CD.)

You can still buy 100BASE-TX hubs if you know where to look, especially so-called "dual-speed hubs". A 10/100 dual-speed hub is effectively a combination of a 10BASE-T hub and a 100BASE-TX hub in the same box, with a 2-port bridge (switch) chip in between the two hubs. If a 100BASE-TX device is connected to a port, that port gets connected to the 100BASE-TX hub. If a 10BASE-T device is connected to a port, that port gets connected to the 10BASE-T hub. So all 100BASE-TX devices can snoop on each others' unicast traffic, and all 10BASE-T devices can snoop on each others' unicast traffic. But the 100BASE-TX devices can't snoop on the 10BASE-T devices' unicast traffic (or vice-versa), because there's a bridge in between.

Since you probably don't have an 10BASE-T-only equipment around anymore, a dual-speed hub is going to be exactly the same as a pure 100BASE-TX hub for your purposes.

And, of course, as others have pointed out, manageable switches often allow you to set up "port mirroring", also known as "port spanning" or "sniffer port" in some products, which allows you to make sure that one port sees all the traffic to/from another port on the switch, for the sake of sniffers and other traffic monitoring tools.

Improve this answer
2
  • Actually, I do have several old HPLNA's sitting around which are only 10MB connections. (I may have just exposed my networking ignorance; I don't know if that's the same as 10BASE-T)
    – Allen
    Apr 5 '14 at 18:02
  • @Allen 10 megabit per second Ethernet over copper cables (any typical "Ethernet cables") is 10BASE-T.
    – Spiff
    Apr 5 '14 at 20:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.