[lug] OT Netwerking Layers 101

[Zan Lynx]

On Tue, 2003-02-18 at 15:21, Warren Sanders wrote:
> I'm testing out NTOP; a network traffic probe that shows the network usage 
> (ntop.org) on our lan.
> 
> Our main panel is an HP ProCurve switch 4000M and is configured to allow my 
> connection to monitor the network.
> 
> Was connected with a 5 port Linksys switch and found I was getting info from 
> only what was going through this switch.  I then replaced it with an old 4 
> port 10 base Netgear hub and I could then see all the network traffic.
> 
> Now I replaced the 5 port Linksys switch with a 5 port Linksys 100 base hub 
> (EFAH05W) and I'm back to only seeing my branch of the network.  Just for 
> kicks I linked off this with another Linksys 10 base hub and moved only my 
> connection to this and can see all the network again!
> 
> So I'm wondering if the Linksys 100 hub is doing something to the network 
> layers that you normally see in a switch (private lines)?  I'm confused!  I 
> don't want to have to us a 10 base hub whenever I need to monitor; why can't 
> the 100's do it?

If the Linksys 100 hub is dual speed, then it might have a switch.  Dual
speed hubs that can accept 10 and 100 mbit connections at the same time
have a hidden switch that handles moving packets from the 10mbit to the
100mbit, and vice versa.

If you need high efficiency, don't put a hub on your monitoring port at
all.  Use a direct connection to your monitoring equipment.  A hub will
introduce collisions and you lose full duplex support.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://lists.lug.boulder.co.us/pipermail/lug/attachments/20030218/e745342f/attachment.pgp>