This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TAP for office firewall?

0

I'd like to start monitoring my office network traffic, and I purchased an old Linksys hub hoping that I could bridge my firewall's LAN port and my laptop in order to grab everything in and out of my firewall. Problem is that I'm not seeing any TCP traffic at all, so my cheap hub has let me down. Can you guys recommend an affordable TAP? Thanks.

asked 12 May '15, 13:50

Shartnado's gravatar image

Shartnado
11●2●2●3
accept rate: 0%

One Answer:

0

A is nowaday no really good idea. Because a hub normaly supports only 10 MBit/s half duplex it may give some special hubs with 100 MBit/s but they even provide only half-duplex.

Better you use a cheap switch with a span port e.g. from DUALCOMM. Perhaps the recommended and cheapest solution to your Use Case.

TAPS provide the most precise capturing solution. You can use different vendors e.g. Garland, NetOptics or Cubro. If you need more precision ( no packet loss intitiated by the of capture equipment) then you should use a tap.

answered 12 May '15, 15:19

Christian_R's gravatar image

Christian_R
1.8k●2●6●25
accept rate: 16%

Thanks for the info!

(13 May '15, 05:30) Shartnado

a TAP is probably overkill.

For cheap switches with port mirroring see here:

https://ask.wireshark.org/questions/13892/port-mirror-switch

(13 May '15, 05:41) Kurt Knochner ♦

Thanks, I'll check that out.

(13 May '15, 10:59) Shartnado