| |
 |
Ethernet Networks, Hubs and Switches
|
In Ethernet networks, hubs and switches are central connection points for the networking of multiple computers or other network devices. Together, these computers form a network segment. On this segment, all computers can "talk" directly to each other. Hubs are less intelligent devices than switches: They simply receive incoming packets on one port and broadcast them to all other ports. This feature makes them ideal for promiscuous network monitoring.
Unlike hubs, switches inspect packets as they are received to check the source and destination MAC addresses and forward them to the correct port. In a switched network environment, a packet analyzer is limited to capturing broadcast and multicast packets and the traffic sent or received by the PC on which it is running. The screen shot below illustrates a typical snapshot of the network activities in a switched network environment:
You can see many broadcast packets being sent from the hosts in your LAN segment to the broadcast IP addresses, but you can't see normal, unicast traffic between these hosts or between these hosts and the Internet. Despite the fact that most switches prevent promiscuous monitoring, a lot of switches can be configured to forward packets to a special monitoring port. We'll discuss the usage of hubs and switches for monitoring purposes below.
|
