| |
 |
Aside from the fact that hubs have lower performance than switches, you can encounter two other problems when using a hub for promiscuous monitoring.
The first problem is related to dual-speed (a.k.a. auto-sensing) hubs that support both 10 Mbps and 100 Mbps hardware. Such hubs don't replicate the data received from the port(s) operating at 10 Mbps to the ports operating at 100 Mbps, and vice versa. This problem can be addressed by configuring all your hardware to run at the same speed. Most multi-speed NICs allow you to "force" a specific speed.
The second problem stems from the fact that some hubs are only labeled as hubs, but inside are switches (some vendors like Linksys do that). These hubs are frequently referred to as "intelligent" or "switching" hubs by the vendor, but this is not always the case. Even without any indication in the documentation, a hub may turn out to be a switch. The only way to find out would be to try. Typically, old and cheap hubs have a greater chance of being "real" hubs. Also, a good indication that the device in front of you is a "real" hub is the Collision LED. Collisions are not possible in a switched environment, so a switch won't have the Collision LED.
|
