Originally Posted by
LAX
From an old post of mine:
The key to making everything work is the Netgear ProSafe GS108E V3 8-port switch with port mirroring. These are currently available online and in most computer stores. I tried other switches that claimed to have port mirroring but something about this particular switch allows it to be "hub-like" instead of restricting the destination port from monitoring activities only. In other words, when I plug my CentOS eth3 connection into the mirrored destination port, it still is able to get an IP via DHCP and act somewhat normal. Other switches I tried did not allow for this functionality at all and were restricted by design to only monitor. Apparently from my testing experience with other consumer level switches, even though Wireshark and tcpdump can see both RX and TX packets from the EQ client IP or MAC, ShowEQ will not play nice unless it has this old school hub type functionality.