sniffing the main pipe feed

Hi,
I have a wireless router connected to my internal network ,a Belkin
56G. My question is when i use ethereal i can only sniff packets on my
internal system, can you set it up to sniff traffic on the main pipe
feed into my cable modem from my ISP


TIA

On Tue, 10 Feb 2004 16:42:56 +0000, Ironfist <> spoketh

>Hi,
>I have a wireless router connected to my internal network ,a Belkin
>56G. My question is when i use ethereal i can only sniff packets on my
>internal system, can you set it up to sniff traffic on the main pipe
>feed into my cable modem from my ISP
>
>
>TIA

You'll need to hook up a hub between your modem and your router, and
connect your ethereal machine there.

Lars M. Hansen
www.hansenonline.net
Remove "bad" from my e-mail address to contact me.

Yes, this works fine and is well worth the $20 or $25 for a hub. But be sure
it's a hub, not a switch - only expensive switches have mirror (debug) ports
that let you see traffic on other ports. It's instructive to just run an
Ethereal trace on the port feeding your modem during a power-cycle of your
router.

"Lars M. Hansen" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On Tue, 10 Feb 2004 16:42:56 +0000, Ironfist <> spoketh
>
> >Hi,
> >I have a wireless router connected to my internal network ,a Belkin
> >56G. My question is when i use ethereal i can only sniff packets on my
> >internal system, can you set it up to sniff traffic on the main pipe
> >feed into my cable modem from my ISP
> >
> >
> >TIA
>
> You'll need to hook up a hub between your modem and your router, and
> connect your ethereal machine there.
>
> Lars M. Hansen
> www.hansenonline.net
> Remove "bad" from my e-mail address to contact me.

On Tue, 10 Feb 2004 21:29:50 GMT, "gary" <(E-Mail Removed)>
wrote:

>Yes, this works fine and is well worth the $20 or $25 for a hub. But be sure
>it's a hub, not a switch - only expensive switches have mirror (debug) ports
>that let you see traffic on other ports. It's instructive to just run an
>Ethereal trace on the port feeding your modem during a power-cycle of your
>router.
>
What type of hub would you suggest is best for this.

>"Lars M. Hansen" <(E-Mail Removed)> wrote in message
>news:(E-Mail Removed).. .
>> On Tue, 10 Feb 2004 16:42:56 +0000, Ironfist <> spoketh
>>
>> >Hi,
>> >I have a wireless router connected to my internal network ,a Belkin
>> >56G. My question is when i use ethereal i can only sniff packets on my
>> >internal system, can you set it up to sniff traffic on the main pipe
>> >feed into my cable modem from my ISP
>> >
>> >
>> >TIA
>>
>> You'll need to hook up a hub between your modem and your router, and
>> connect your ethereal machine there.
>>
>> Lars M. Hansen
>> www.hansenonline.net
>> Remove "bad" from my e-mail address to contact me.
>

What about security, will the hub offer any protection to my system?

On Wed, 11 Feb 2004 10:42:04 +0000, Ironfist <> spoketh

>
>What type of hub would you suggest is best for this.

Any. As long as it is a hub and not a switch.

>
>What about security, will the hub offer any protection to my system?
>

No security in a hub. You'll have to secure your ethereal box, and
perhaps not give it an IP address...

Lars M. Hansen
www.hansenonline.net
Remove "bad" from my e-mail address to contact me.

On Wed, 11 Feb 2004 11:51:19 GMT, Lars M. Hansen
<(E-Mail Removed)> wrote:

>On Wed, 11 Feb 2004 10:42:04 +0000, Ironfist <> spoketh
>
>>
>>What type of hub would you suggest is best for this.
>
>Any. As long as it is a hub and not a switch.
>
>>
>>What about security, will the hub offer any protection to my system?
>>
>
>No security in a hub. You'll have to secure your ethereal box, and
>perhaps not give it an IP address...

Thanks for the advise :-))
>
>Lars M. Hansen
>www.hansenonline.net
>Remove "bad" from my e-mail address to contact me.

<Ironfist> wrote in message
news:(E-Mail Removed)...
> On Wed, 11 Feb 2004 11:51:19 GMT, Lars M. Hansen
> <(E-Mail Removed)> wrote:
>
> >On Wed, 11 Feb 2004 10:42:04 +0000, Ironfist <> spoketh
> >
> >>
> >>What type of hub would you suggest is best for this.
> >
> >Any. As long as it is a hub and not a switch.

DLink, Linksys, and others make perfectly serviceable hubs.

> >
> >>
> >>What about security, will the hub offer any protection to my system?

A hub must be physically secured, If you're not worried about unauthorized
people plugging into the Ethernet ports on your router, then you should not
be worried about them plugging into your hub. Security on the wifi net is
not affected at all.

> >>
> >
> >No security in a hub. You'll have to secure your ethereal box, and
> >perhaps not give it an IP address...
>
> Thanks for the advise :-))
> >
> >Lars M. Hansen
> >www.hansenonline.net
> >Remove "bad" from my e-mail address to contact me.
>

<Ironfist> wrote in message
news:(E-Mail Removed)...
> On Tue, 10 Feb 2004 21:29:50 GMT, "gary" <(E-Mail Removed)>
> wrote:
>
> >Yes, this works fine and is well worth the $20 or $25 for a hub. But be
sure
> >it's a hub, not a switch - only expensive switches have mirror (debug)
ports
> >that let you see traffic on other ports. It's instructive to just run an
> >Ethereal trace on the port feeding your modem during a power-cycle of
your
> >router.
> >
> What type of hub would you suggest is best for this.

a cheap 2nd hand one - i have a 3com office connect TPC (10M hub with 8
ports) - it cost £5 ($9) a couple of years back
>
> >"Lars M. Hansen" <(E-Mail Removed)> wrote in message
> >news:(E-Mail Removed).. .
> >> On Tue, 10 Feb 2004 16:42:56 +0000, Ironfist <> spoketh
> >>
> >> >Hi,
> >> >I have a wireless router connected to my internal network ,a Belkin
> >> >56G. My question is when i use ethereal i can only sniff packets on my
> >> >internal system, can you set it up to sniff traffic on the main pipe
> >> >feed into my cable modem from my ISP
> >> >
> >> >
> >> >TIA
> >>
> >> You'll need to hook up a hub between your modem and your router, and
> >> connect your ethereal machine there.
> >>
> >> Lars M. Hansen
> >> www.hansenonline.net
> >> Remove "bad" from my e-mail address to contact me.
> >
>
> What about security, will the hub offer any protection to my system?

dont put an IP address on the interface.

if you want to do this periodically, then a 2nd ethernet NIC with no IP
address in the analysis PC will work, so long as Ethereal will let you
choose which interface to "sniff" - this is how the Sniffer PRO i use
sometimes at work is set up.
--
Regards

Stephen Hope - remove xx from email to reply

"shope" <(E-Mail Removed)> wrote in message
news:0ZvWb.3760$(E-Mail Removed)...

> > >
> >
> > What about security, will the hub offer any protection to my system?
>
> dont put an IP address on the interface.
>
> if you want to do this periodically, then a 2nd ethernet NIC with no IP
> address in the analysis PC will work, so long as Ethereal will let you
> choose which interface to "sniff" - this is how the Sniffer PRO i use
> sometimes at work is set up.
> --
> Regards
>
> Stephen Hope - remove xx from email to reply
>
>

What I normally do, if I leave the Ethernet connected to the wifi router, is
disable all client services, plus TCP/IP, via the Ethernet lan connection
dialog. That prevents the client from having two IP addresses on the same
net, which can confuse it. Ethereal capture works just fine without the
stack being set up. BTW, you want to be sure capture is set to promiscuous
mode (default).

If you leave the Ethernet connected to the hub (with the hub between the
router and the modem), then normally you don't have any security issue at
all. Just be sure you disable or remove any software PPOE connection manager
on your laptop, or at least be sure it does not run against the Ethernet
port. With no PPOE connection, the ISP will not route your Ethernet port to
the Internet.

In article <(E-Mail Removed)>, Ironfist <> wrote:
>On Tue, 10 Feb 2004 21:29:50 GMT, "gary" <(E-Mail Removed)>
>wrote:
>
>>Yes, this works fine and is well worth the $20 or $25 for a hub. But be sure
>>it's a hub, not a switch - only expensive switches have mirror (debug) ports
>>that let you see traffic on other ports. It's instructive to just run an
>>Ethereal trace on the port feeding your modem during a power-cycle of your
>>router.
>>
>What type of hub would you suggest is best for this.


Ebay makes a great hub :-)

(That's where I got mine. I think I paid less than $20 inclding
shipping. )



>
>>"Lars M. Hansen" <(E-Mail Removed)> wrote in message
>>news:(E-Mail Removed). ..
>>> On Tue, 10 Feb 2004 16:42:56 +0000, Ironfist <> spoketh
>>>
>>> >Hi,
>>> >I have a wireless router connected to my internal network ,a Belkin
>>> >56G. My question is when i use ethereal i can only sniff packets on my
>>> >internal system, can you set it up to sniff traffic on the main pipe
>>> >feed into my cable modem from my ISP
>>> >
>>> >
>>> >TIA
>>>
>>> You'll need to hook up a hub between your modem and your router, and
>>> connect your ethereal machine there.
>>>
>>> Lars M. Hansen
>>> www.hansenonline.net
>>> Remove "bad" from my e-mail address to contact me.
>>
>
>What about security, will the hub offer any protection to my system?
>
>


--
Al Dykes
-----------
(E-Mail Removed)