Hubs that work

[Untalented]

Do brand new DS104 and DS105 hubs work? Or do you have to buy some older ones?

[purple]

I believe they work but only if both machines are 10Mbit or 100Mbit. If one is 10Mbit and the other 100Mbit, it won't.

[Latigid]

What Purple said.

[castle9mm]

Not sure how many people know this but I think it's pretty cool.

It is possible to use showeq over a switch using Ettercap NG (by arp poisoning). I'm using the setup now and have not noticed any wierdness. Probably not noob friendly but just wanted to mention it was possible.

...
castle

[modsiw]

I tried 3 "hubs" all ended up being switches. Traded one for a 10mbit hub that may be older than I am.

[horseshoecrab]

--------------------------------------------------------------------------------

Not sure how many people know this but I think it's pretty cool.

It is possible to use showeq over a switch using Ettercap NG (by arp poisoning). I'm using the setup now and have not noticed any wierdness. Probably not noob friendly but just wanted to mention it was possible.

I'm a "noob", could you please explain this process? It sounds very cool.

[UnGod]

I have a linksys wireless router, it's got a built in 4 port switch, I actually used a slightly modified version of udpecho to echo EQ traffic back across the same NIC but directed towards the showeq machine, which worked pretty good.

[horseshoecrab]

This thread is going to give me a headache, primarily because I don't know enough about networks and their basic functionality to grok the UDP Echo or Ettercap software. The links I looked at in Google took me to places that seemed to be largely focused on DNS attacks.

Is there any chance somebody could provide a dumbed-down explanation of either of the techniques for either of these applications? Even after reading the generic explanations of the software mentioned above, it wasn't even clear to me whether either of these packages ends up on the SEQ or Windows machine...

Perhaps the information provided here could end up in the FAQ as an alternative to the hub requirement of the SEQ network topology?

edit...

I finally found what I believe to be the udpecho program mentioned earlier at http://www.freewebz.com/winseq/ This particular software seems to expect a modem as the in-source for EQ and a NIC as the UDP output to SEQ. Is it possible to use the same NIC for the in and the out? So "udpecho 0 0" is what I'd want to use? I recently killed my SEQ and Linux installation because I was bored and wanted to try out MySEQ. After trying it out, I'd like to come back to SEQ but would also like to be running from a switch if at all possible. But then again I'd hate to do all that software installation and be disappointed at the end if this doesn't work.

Thanks in advance.

[elf]

No, I don't see this ending up in the FAQ as an alternative, because if you can pull this off you probably already have (or could have) a few network professional certifications. It's not difficult to set up, but the idea behind it can be hard to grasp.

If I understand the Ettercap method properly, you have both the switch and the EQ computer thinking that data needs to go to your showeq box before it goes to the internet. It does this because of the way switches work and talk to each other, so some understanding of Spanning Tree Protocol is needed. You have Ettercap act like another switch that is closer to the EQ box then the real switch thinks it is. Seeing how it's directly connected, that's where you run into some tricks.

UDPEcho on the other hand, probably ends up on the EQ machine, and just repeats every piece of data it gets back to the SEQ box. That would require either UnGods code or knowing some C and changing the code. Again, not impossible, but not something I think the devs want to help everyone try to walk through.

So, the final "noob" explaination is this: while using EttercapNG instead of a switch will teach you alot about switches and network technology, it requires a basic understanding of it, I'd say beyond even what the N+ exam might take. If you are not familier with the technology and wish to learn, get a switch and run it, but you won't get ShowEQ running the first few days. If you do not with to learn, then it will be a much better use of your time watching ebay or pricewatch.com for known hubs.

PS: want to learn networking the hard way? Read IEEE 802.3 specifications for 10 BASE T ethernet.

[horseshoecrab]

Thanks Elf. I was pretty much coming to the same conclusions about the feasibility of a novice like myself actually getting Ettercap to work.

UnGod, any chance you'd be willing to share your modified binary please? It sounds like the best and easiest way to go.

[CSHELL]

I recommend e-bay. My netgear 4 port hub works great and only cost me $10....That included the shipping to my home.

[I<3EQ]

This is an interesting topic to me because it's one that's finally come up for me. For the longest time, I've been perfectly happy to run my network on an variety of hubs (the latest being an extremely nice 3Com office connect). Lately, though, I've wanted more speed to my fileserver (also my SEQ box) so I've been eyeing gigabit ethernet.

So... long story short, I banged my head on this for awhile and wasn't sure what I was going to do. Then, I realized that the answer is amazingly simple (in theory, not so much in execution, this is also NOT a newbie solution). Here's what I plan on doing:

{internet} -> [Linux machine set up as a router (also running SEQ)] -> [gigabit switch] -> {my network, including my EQ machine}

I've never configured routing in Linux before so it's become an interesting exercise. There's plenty of documentation out there on setting up things like this so please don't ask for how-to's.

[Zaphod]

{internet} -> [Linux machine set up as a router (also running SEQ)] -> [gigabit switch] -> {my network, including my EQ machine}

Setting the Linux box up as a router is fairly straight forward, may I suggest that you configure it as a firewall/router using iptables. You may consider setting up IP masquerading as well. You'd be amazed at how often strange random people will try to attack your computer... Plenty of docs available and guidance on all that at the The Linux Documentation Project. Personally I found fwbuilder a handy tool for it, although it may be a bit advanced for some.

Enjoy,
Zahod (dohpaZ)

[purple]

Is your outbound net connection gigabit? More than likely not. If so, and you just want to throw hardware at it, then I'd recommend doing:
{internet}->{cable/dsl modem}->{linksys router}->{netgear hub}

And then do:
{netgear hub}->{seq box, eth1}
{netgear hub}->{gigabit switch}

And then:
{gigabit switch}->{rest of network}
{gigabit switch}->{seq box, eth0}

In this way, all your machines are connected with the gigabit backbone and you can use eth1 or whatever the 2nd nic in your linux box is to also sniff all outgoing network packets. Don't route anything out eth1, just use it for sniffing. Setup your default route through eth0 and the gigabit switch.

[horseshoecrab]

Thanks for all the feedback guys. My SEQ box is a funky notebook with 1 NIC and no PCMCIA slots. It's odd I know; but hey, free is free.

In the absence of an available secondary NIC and my lack of knowledge regarding LAN stuff, I'll stick with the traditional hub solution. My desire to have a non-traditional configuration was not born so much out of necessity as much as it was curiosity and a desire to tinker. Please don't waste anymore time on my question unless you too find it an interesting puzzle as I do.