[lug] OT Netwerking Layers 101

[Toni Janz]

* Warren Sanders <sanders at montanalinux.org> Dated [02/18/03 15:39] wrote:
> I'm testing out NTOP; a network traffic probe that shows the network usage 
> (ntop.org) on our lan.
> 
> Our main panel is an HP ProCurve switch 4000M and is configured to allow my 
> connection to monitor the network.
> 
> Was connected with a 5 port Linksys switch and found I was getting info 
> from only what was going through this switch.  I then replaced it with an 
> old 4 port 10 base Netgear hub and I could then see all the network traffic.
> 
> Now I replaced the 5 port Linksys switch with a 5 port Linksys 100 base hub 
> (EFAH05W) and I'm back to only seeing my branch of the network.  Just for 
> kicks I linked off this with another Linksys 10 base hub and moved only my 
> connection to this and can see all the network again!
> 
> So I'm wondering if the Linksys 100 hub is doing something to the network 
> layers that you normally see in a switch (private lines)?  I'm confused!  I 
> don't want to have to us a 10 base hub whenever I need to monitor; why 
> can't the 100's do it?
> 
> Thanks for any insight,
> -- 
> Warren Sanders
> http://MontanaLinux.Org
> 
> 
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: lug.boulder.co.us port=6667 channel=#colug

Your noticing the difference between a 'switched' network and a hubbed
one.

Switched networks are basically exacly what they sound like, the
hardware matches up addresses at the MAC level and only broadcases to
those who are involved in any given transaction. Think of a very
industrious gnome hiding in the hardware crossing the appropreate wires. 

Hubs are more 'lazy' they send everything to every interface regardless
of who is talking, this makes them a bit less efficient and easier to
sniff on. Think of a different gnome who has partied a bit too much and
so has elected to throw all the switches and not bother doing any work.

If you don't get my illustration here is one that's a bit clearer:

** note: you will need javascript enabled **
http://www.proxim.com/learn/library/guides/gd2001-07-17.html

Toni