On 15 Jun 2001, Nicholas Bastin wrote: > On 13 Jun 2001 16:23:51 +0200, Peter Wächtler wrote: > > Am Mittwoch, 13. Juni 2001 15:59 schrieb Jing Shen: > > > if you want to monitor all traffic between NodeA and NodeB, perhaps you > > > can use: > > > > > > tcpdump -v host node-b-ip-address > > > > > > > I think the problem is the intelligent HUB (switching Hub): it learns the MAC > > addresses on its ports and forward only the traffic to this MAC and > > of course broadcast packets. The seen NetBIOS traffic is broadcast. > > > I don't know about you, but to me, it's either a switch, or it's not. > Since he plainly labeled one device in the diagram as a switch, and one > as a hub, I'm assuming he knows the difference. There is no such thing > as a switching hub - it's either a switch, or a hub, not both. In any > case, his problem may be that he's not in promiscuous mode, for some > reason or another, or he actually *does* have a switch there (not > intelligent hub, not switching hub, just *switch*). > > Yarg. > > -- > Nick Bastin What do you consider a hub that does both 10mbs and 100mbs? What do you consider bridges? Are they 'hubs' or 'switches'? As far as I know, a dual speed hub acts as a 2 sided switch (or you can call it a bridge) between the 10mbs and 100mbs stations. i.e. all of the 100mbs stations see all the traffic sent to/generated by the 100mbs stations, and the 10mbs see all the traffic sent to/generated by the 10mbs stations. The multicast traffic obviously goes to all stations. If a 10mbs station was talking to a 100mbs station, then all stations would see the traffic. This is what I think the original posters problem is. He's got both 10 and 100mbs stations and isn't sniffing from the same 'speed' port. -kf - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org
