This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Would an old mini-hub work as a TAP?

0

Happy to join the frenzy. I've got 7 switches on my one-segment LAN here, and I'd like to capture some trace files at the gateway. I don't have a TAP, and was wondering if an old-school hub might work, as hubs don't forward at the MAC level. It's a 4-port mini-hub, and I was going to plug my laptop and my daisy-chained switches into it with Wireshark running on my laptop. Yay or nay? Thanks.

asked 26 Feb '14, 08:29

Shartnado's gravatar image

Shartnado
11223
accept rate: 0%


One Answer:

2

Assuming your "hub" is an old-fashioned ethernet repeater, then yes. We use netgear hubs all the time for that at my work. (Netgear doesn't make them anymore - but you can find them on Ebay)

The term "hub" stopped being synonymous with repeaters a long time ago though. For example a bunch of companies made ethernet "hubs" with one or two fast-ethernet ports, and to accomplish that you have to bridge (ie, switch) between those two domains; but some of them at least repeated within the domain, so that all ethernet 10mbps (10Base-T) ports were repeater ports, while it bridged to/from the 100mbps fast ethernet (100Base-TX) port.

But it's not hard to find out - just insert the hub in-between two of your switches, connect your PC running wireshark to the hub, send some packets across the two switches (like ICMP ping), and see if wireshark sees the packets (other than the ARP packets, which it will see regardless since they're broadcast).

answered 26 Feb '14, 15:50

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%