On Fri, Nov 7, 2008 at 12:21 PM, Ryan Zuidema <Ryan.Zuidema@xxxxxxxxxxx> wrote:
> ARP poisoning is a destructive means of gathering traffic. If you are
> concerned at all about the performance/usability of your network do not use
> ARP poisoning.
>
> A better bet is to use a span/mirrored port on a managed switch. Setting up
> a linux box as an inline router/capture device would work as well. If all
> else fails you can use a hub, or static ARP table entries.
>
> Using ARP poisoning on a network you control is like using a crowbar to
> enter your own house.
>
> Ryan Zuidema
Thanks Ryan, I'm pretty new to all this packet capturing so ARP
poisoning was my first working solution. I didn't want to go through
the trouble of moving every thing around and cant find any info on
spanning or mirroring with dd-wrt. The hub just wouldn't really fit
with my network unless I added another router which I could do but
then it would just be something else I had to power and mess with. I
think the best way for me to grab packets is to just use my Linux box.
Guess I better go brush off my iptables books.