HubReference

Hub Reference

Are there any Gigabit hubs?

General

This page tells you which devices are hubs and which aren't.

As described in the CaptureSetup section (especially the CaptureSetup/Ethernet page), hubs can be useful for capturing. Unfortunately, many "hubs" are actually switches these days. Information about (managable) switches can be found at the SwitchReference. Tap information can be found at TapReference.

In general, if you find something with "full-duplex" in the device description, this is in fact a switch and not a hub. This is often the case with 100MBit Ethernet devices.

If you use a 10MBit hub, and it's stated to be a hub, it will be a hub.

Dual-speed hub warning

Note that "dual-speed" hubs that support both 10MBit and 100MBit ports might not send all unicast traffic between 10MBit and 100MBit ports; if so, you can only capture all traffic between hosts whose Ethernet interfaces are both running at the same speed as the Ethernet interface on the machine capturing traffic.

This means that if you have two hosts communicating at 100MBit/s, you will only be able to capture the traffic between them if the Ethernet interface of the machine capturing traffic is configured for 100MBit/s. Similarly, if you have two hosts communicating at 10MBit/s, you will only be able to capture the traffic between them if the Ethernet interface of the machine capturing traffic is configured for 10MBit/s, which is probably not the default configuration.

Some dual-speed hubs don't connect the 10MBit and 100MBit ports at all; with those hubs, two hosts whose Ethernet interfaces are running at different speeds will not be able to communicate, so there's no traffic between hosts of different speeds, and thus no traffic between them to capture.

Other dual-speed hubs have an internal switch connecting the 10MBit and 100 Mbit ports, so that only broadcast and multicast traffic, and unicast traffic to the host on a particular port, will be sent to that port if the traffic comes from a port with a different speed; with those hubs, two hosts whose Ethernet interfaces are running at different speeds will be able to communicate.

If you have a dual-speed hub with an internal switch, it means that if you have a 10MBit host communicating with a 100MBit host and you will only be able to see one direction of that traffic; you will only see the traffic from the 10MBit host if the interface of the machine capturing traffic is configured for 10Mbit/s, and you will only see the traffic from the 100 Mbit host if the interface of the machine capturing traffic is configured for 100MBit/s.

Workaround (Tested & Verified on Netgear Dual Speed HUB)

Configure capturing PC/Latop(windows) with an IP address in the Sub-Network of interested, then immediately you see traffic from the hosts in that Sub-Network inadditon to broadcast traffic. You can configure additional IP addresses on the interface if the HUB happen to connected with multiple networks (bad practice), so that you see the traffic from all the networks on the Hub. Could not find the reason behnd this ? hopefully somebody will provide the reason.

Some simplified Ethernet history

As with early 10MBit, the "line-based topology" (thick/thin "coax" Ethernet) was state of the art. The invention of hubs made the "star-based topology" (twisted pair, RJ45) widely accepted. Later, nearly at the "same time", both 100MBit and switches hit the market, so you could get 10MBit Switches and 100MBit Hubs (and really expensive 100MBit Switches for quite a while). Every device after that period will certainly be a 10/100MBit (or 100MBit only) switch, probably with some exceptions.

I don't know if the above is true for other networks than Ethernet, but I suspect it is.

REAL HUBS:

Devices that are real hubs; convenient for capturing. Side Note: This category could really be broken into hubs that are real hubs (i.e. repeaters) and hubs that are really switches with learning disabled. Most new hubs are in the latter category as it is a cost effective way for manufacturers to produce hubs using the same chips as their switches. The difference from a packet sniffing point of view is that the hub based on switch technology will only forward 'clean' packets whereas a genuine hub is an electrical repeater and has no knowledge of what a packet should look like. You could have a device on your network spitting out all kinds of malformed junk but if you're sniffing via a switch type hub, you won't see it. Neither is to be confused with a switch which operates as a switch (i.e. learns and maintains a MAC address table) but has been called a hub by well meaning but ultimately dumb people in marketing.

Please add information to this list about models you know (including valuable info such as link speed and the like) ....

3Com

Asante

D-Link

Dynex
Seemingly manufactured for Best Buy (from looking at the box), these are currently available in B&M Best Buys (as of August, 2006). (still found as of Apr 2008)

Edimax
Edimax still has a number of hubs available according to their "Fast Ethernet Switches / Hub" list:

Andreas Sikkema

Garrett Communications

Hawking

Hewlett-Packard

Intel

Level One

Linksys

NETGEAR

NDC

Phoenix Contact

Planet

SMC

W-linx

FAKE HUBS:

Devices that claim to be hubs, but in fact are switches.

Please add information to this list about models you know (including valuable info such as link speed and the like) ....

3Com

OfficeConnect Dual Speed Hubs From the 3com site: "The OfficeConnect Dual Speed Hub 8 features eight 10/100 Mbps Ethernet hub ports that automatically sense and match the speed of an attached network device to optimize performance. An internal built-in switch seamlessly connects users."

Asante

Linksys

Allied Telesyn

SMC

ZIO

Intel

Genius KYE SYSTEM CORP

Versa-stack 16-port dual speed hub - appears to be a switch not a hub (Dave W)

FURTHER COMMENTS

If you know how to make a simple hub from off-the-shelf components, please let us know. Something like a "T-connector" with 3 RJ-45 connectors would be great.

Hub, or network tap? If it's a network tap, see http://www.snort.org/docs/tap/, linked to from CaptureSetup/Ethernet -- Guy Harris

Imported from https://wiki.wireshark.org/HubReference on 2020-08-11 23:14:50 UTC