Looking for a small, portable, port-mirroring ethernet switch

Question

I recently had a mac go haywire, taking half a minute or more to get www.google.com loaded. Getting its owner to give up the machine for repair was like pulling teeth - they were insisting that it must be something to do with the network, since so much had changed with the local configuration at about the same time their box went haywire.

I eventually set up a port mirror to a box that I could remote to so I could show that the mac was only irregularly getting packets onto the network. Demonstrating this faced an additional challenge: the latency of the remote desktop software I was using meant that I had to point to timestamps instead of just the moment the packet flashed up on the screen as my evidence.

This particular user was the reason this was so challenging this time around, but I would like to have a box that I can cart from desk to desk to use wireshark on my laptop at any station where I need it. 3com, cisco, netgear, etc. (ad nauseum), all make switches that can be configured for port mirroring, but in my case, the smaller, the better. For the sake of my sanity, I'll probably end up running it off a battery anyway.

If my laptop had two ethernet ports, this would be easy.

So, whaddya recommand for a device that requires 0 configuration at each powerup (though I'm fine with poking at it for a while to set it up initially.) Small, light, and cheap enough to get it past purchasing?

Thanks,

Solution 1

I bought a Cisco\Linksys SRW208 a few years ago fairly cheap.

http://www.cisco.com/en/US/products/ps9974/index.html

Solution 2

Just get a small hub unless you need some of the fancy managed switch features such as vlans. But it may be hard to find a hub these days.

Solution 3

I've been searching for the same thing for home and mobile use. For mobile use, I chose this. Small, extremely portable, and very inexpensive: Price: $39.95. http://www.dual-comm.com/port-mirroring-LAN_switch.htm

Solution 4

If you want Gigabit, look at the Cisco/Linksys SLM2005 and SLM2008.

http://www.cisco.com/en/US/products/ps9994/prod_models_comparison.html

The SLM2005 has a street price of around $90. As just a 5-port switch, it's not very big. It contains lots of other management features in addition to port mirroring as well.

View more solutions

Comments

[user37244]

Exactly my issue. Hubs have become so passe that it seems that every hub on the market is being marketed as a "hub/switch" or something similar - they're actually switches. Come to think of it, the device I use at home falls into this category.

[user37244]

I did the ebay search earlier and hit the same problem there as on retailers: the terms hub and switch seem to be used interchangeably, despite the clear distinction between what they do.

[Spiff]

Hubs were common back in the 10mbit days, but were rare in the 100mbit days (except so-called "dual-speed" hubs that could end up acting as switches in some situations, so wouldn't be recommended for someone that wants to capture another machine's unicast traffic). There's no such thing as a Gigabit hub (the GigE spec mandates switches), so if he ends up needing to look at a problem that only happens at gigabit rates, he'll still need a switch capable of port mirroring.

[Thomas Weller]

You don't want to modify/destroy the network for debugging purposes.