Packet sniffing with a Switch instead of a hub

[TheSteelDragon]

LordCrush, in a reply to Tristatic about SEQ not getting packets, posted a link and some information about methods to sniff on a switch. He said he had not yet tried any, but as my SEQ was running and receiving no packets I thought I would give it a try. I have a ZyXEL 642R-11 ADSL router with the LAN port connected to the WAN port on my SMC Barricade router/switch model SMC7704ABR. I have 4 machines hooked to the switch, 2 in 10Mbit mode, 2 in 100Mbit mode, where the Linux box and the EQ client are on the 100Mbit connections. SEQ was receiving no packets after initial compile and set up.

The EQ client runs on a machine with IP 192.168.2.213 and the Linux box has an IP of 192.168.2.9. The Linux box is running a full install of RedHat Linux 8.0. After compiling and installing per the instructions given in the install-newbie file found in the SEQ archive, I obtained the dsniff RPM from http://www.falsehope.com/ftp-site/home/gomez/dsniff/ and installed it as well. It did require 2 additional packages to be installed of my RedHat CD's. I then intiated two terminal windows, put them in su mode and executed the command /usr/sbin/arpspoof 192.168.2.213. At this point my EQ client machine running Windows XP Pro threw an error message that there were machines with duplicate IP addresses on the network. I ignored the error and started EQ, while I switched to the other terminal window on my Linux machine. I started SEQ, logged in my EQ character, and had the zone map appear on my SEQ.

I still have to figure out exactly how to best set up SEQ and utilize the information it provides, but IT WORKS!!! Thanks to all who help to provide this fine product and I hope this information is helpful to others.

[fester]

Sounds like a bad idea to me.

What sounds better to me, is to inform Linux to route packets (make menuconfig option) and then set the host PC up to be static IP (not DHCP) and assign the gateway to be the linux machine and the linux machine gateway to the smc barracade.

Ex:

baracade 192.168.1.1

linux 192.168.1.2 (default gateway to 192.168.1.1)

windows 192.168.1.3 (default gateway to 192.168.1.2)

This will work just fine (I have done this on a network for OTHER reasons before.)

[LordCrush]

TheSteelDragon,

nice to read that it works in a way ... as i wrote i have not tested it yet (no time ), i will try to make the setup, because i want to get the hub out of my network

fester,

Yep this will work for every network, but it depends on your cabeling and other circumstands if you can use that solution. The easiest it would be if your Linux-Box is already the router. I have a Win2K-Box as router (*flame on* ) for some reasons (i.e. i run a gamevoice server there ).

[throx]

fester,

In that case, shouldn't the linux box just send an ICMP redirect to the windows box, which means you'll only see the first packet, or have you disabled the sending of redirects?

[wfj5444]

Collisions are the debil!


Glad this worked for you but those of us who have less than new computers are better letting the hub spew packets around then getting our gimpy linux boxes to snoop them



But again really great that this is an option.

[TheSteelDragon]

I agree that acquiring a real hub or setting up a linux gateway are both better long term solutions. I believe that I will continue to operate in this manner until I receive the hub I ordered. I really didn't want to wait to begin using ShowEQ. I may be wrong, but I felt that one advantage of this setup over using my single linux machine as a gateway was that failure of my linux machine does not adversely affect my EQ play. I did have ShowEQ crash once, and the enitre machine lock up once last night while screwing around with it, and was able to continue playing without incident. Also I felt this would be useful information for those who for monetary or other reasons are unable acquire a true hub or set up a linux gateway.

BTW, Can anyone tell me how to keep pushy four-footed furry creatures from crashing machines while in use other than removal of said creatures?