Convert a switch into a hub

alanchia2000 · ‎06-08-2005

Is there a way to convert a Catalyst 2950 to a hub? I need to sniffer packets, and do not have a hub but a switch.

anand · ‎06-08-2005

just make all the ports as half duplex.

Kevin Dorrell · ‎06-08-2005

Unfortunately, there is no way to this this fully. You can sniff a limited number of ports (can't remember exactly how many in the 2950, but I think it's 4 ports) using SPAN. Look for the monitor session command in the documentation. You can monitor the uplink, and that would give you most of the traffic.

Kevin Dorrell

Luxembourg

alanchia2000 · ‎06-08-2005

Hi Kevin,

Thanks for the note. But I wasn't exactly looking for switchport port analyzers. In fact, I have a core switch already doing SPAN, and I want those monitored sessions to be redirected to a hub so that I can connect different type of sniffers going to that hub. Since I have no hubs to start with, I will use what I have which is a Catalyst 2950.

Any idea on how to convert a switch into a hub?

szahid · ‎06-08-2005

The one thing that swithes do is mac-learning that sets them apart from Hubs. There is no support for disabling mac-learning in these switches today . If there was , you can turn a switch into a hub. AFAIK , you cannot turn 2950 into a hub , i.e to say you can not disable mac-learning.

thanks

Salman Z.

frenzeus · ‎06-08-2005

Here's what i think u could do..

get a mac-address flooding tool. ie. dsniff, macof.. when u flood the cam table of the switch with bogus mac-address, fill the cam table to the brim, then the switch will start acting like a hub.

If the switch can't learn anymore mac-address, (since it's filled up with bogus macs) it'll start forwarding incoming packets out all ports. There u go, u hv a hub. ;)

milan.kulik · ‎06-09-2005

Don't you think it would be much more effective to spend 10 USD for a noname 8-port hub?

Regards,

Milan

borepstein1 · ‎05-12-2015

Kevin,

Why do you think it should be this way? I think I just did this (on a 3550 series switch, notably - but still).

Here's the CLI code:

interface VLAN2
 no ip directed-broadcast
 no ip route-cache
 shutdown
!


interface range Fa0/1-3
 switchport access vlan 2
 switchport trunk encapsulation dot1q
 switchport mode trunk
!

Details: http://stackoverflow.com/questions/21507279/how-to-convert-cisco-switch-to-hub

Kevin Dorrell · ‎05-12-2015

That still makes it a switch, not a hub.

Once a switch sees a frame coming into a port, it observes the source MAC address in the frame and associates that MAC address with that port. When it has a frame to forward to that MAC address it will forward it to that port only. It is still acting as a transparent bridge. A port will not transmit frames destined to any MAC addresses the switch has seen on other ports.

The characteristic of a hub is it will forward all frames to all ports except the one it received it on.

Kevin

Kevin Dorrell · ‎05-12-2015

Actually, I have just thought of something that might work, but on one VLAN only ... declare the VLAN as a SPAN VLAN. I believe that disables learning for that VLAN. I've not tried it, but I think it should work.

Kevin