Ethereal-users: Re: [Ethereal-users] Only Seeing Outgoing Packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Sat, 21 Jan 2006 21:15:15 -0800
At 06:45 PM 1/21/2006, Guy Harris wrote:
Ulf Lamping wrote:

As you mention it, the wiki says: "Note that "dual-speed" hubs that support both 10MBit and 100MBit ports might not send unicast traffic between 10MBit and 100MBit ports; if so, you can only capture traffic between hosts whose Ethernet interfaces are running at the same speed as the Ethernet interface on the machine capturing traffic."

I've expanded that part of the HubReference page to give more detail, describing the scenario I outlined in an earlier message.

The bridge between the two speeds seems to be a (bit of a) switch. I've added your hub to the wiki and mentioned the bridge problems.

I'm assuming there are at least two types of dual-speed hubs - one type with *no* bridge between the speeds, which I assume means that a 10Mb/s host and a 100Mb/s host plugged into the hub can't communicate at all (so there's no traffic between them to capture), and one type with a switch between them (so that broadcast and multicast traffic are passed between the speeds, and unicast traffic is passed to the port to which it's being sent), which I assume means that a 10Mb/s host and a 100Mb/s host plugged into the hub can communicate, but another host plugged into the hub can only see one side of the conversation.

I can't imagine there would be a dual speed hub with no connection between the 10 Mb and 100 Mb hubs. It doesn't seem to be useful behavior.

If each half really is a hub (all 10 Mb unicast traffic goes to all 10 Mb ports), then I would think all unicast traffic that goes across the internal switch would go to all ports - if it doesn't, then each half isn't really a hub and shouldn't behave like one for traffic between ports.

(Are there any dual-speed hubs that pass *all* traffic? I could imagine a lot of 100Mb/s traffic flooding a 10Mb/s port in that case.)

I wouldn't think so because most of the 100 Mb traffic would get dropped by the 10 Mb hub due to flooding.