[mythtv-users] Time Warner Junking STB's

[Stephen P. Villano]

On 11/25/13 12:00 PM, Jay Ashworth wrote:
> ----- Original Message -----
>> From: "Doug Lytle" <support at drdos.info>
>> Or, having an old HUB laying around.
> 100BaseT hubs were fairly rare; I'd be surprised if you could easily
> find one laying around these days.  HP 4900B's are way to easy to find,
> and too cheap, to make hunting up such a hub useful unless you already 
> have one in hand -- and of course, GigE was never hubbed; always switched.
>
> Cheers,
> -- jra
>
At home, I have a C4506 as my core switch, easy to mirror traffic from a
port or a range of ports.
One unmanaged switch is in my bedroom. As it's gigabit, I leave it alone
and if I have to sniff, I'll monitor the 4506 port feeding it, then go
by MAC address to figure out traffic origination.

At one place of work, I had two nearly fully populated C6509's per
network, plus C4509's (two per each network, nearly fully populated and
dozens of 24 and 48 port switches in various buildings.
Usually, if there was a problem, we mirrored one of the 6509's, then
filtered via Wireshark filters for the traffic of interest.
We also had inline sensors, which performed traffic analysis for certain
undesired types of traffic. Actually, several layers of the things, some
at our location, others at the primary links before traffic was filtered
as either local or internet.
To say that the problem could be complicated is to be mild.
In that particular network, we also used RSPAN and ERSPAN (different
types of remote mirroring unique to Cisco (their mirroring is called
SPAN). I'll not go into problems one can cause oneself if one unwisely
mirrors certain ports, due to incompatibilities with certain switching
protocols.
Like any other powerful tool, there are caveats. So, one plans accordingly.