Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to tcpdump all traffic that my router does when it makes a firmware update.

So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8.

I have connected:

  • Internet connection in port 6
  • routers WAN port in port 7
  • Linux host running tcpdump in port 8

I suppose the router have a dhcp client on the WAN interface.

However I don't see any activity. Not even the switch leds show activity for port 6 and 7.


Do I have to configure something more in the switch in order use it as a network tap?


Maybe it is the cables that are the problem? The router uses RJ11, so how should the RJ11 pins be connected to the RJ45 pins?

The ones I am using now are from an answering machine for port 6 and port 7.

HP ProCurve    6|---------------- Internet Uplink -------------- (Internet)
1800-8G         |            :
Switch          |            : <== (router-to-uplink path before tap)
(as a tap)      |            :                         
               7|---------------- Router WAN port (downlink) --- (local n/w)
               8|------------ Linux Host (with tcpdump)
share|improve this question
•Internet connection in port 6 •routers WAN port in port 7... I'm having a hard time visualizing this. Can you provide a diagram? – joeqwerty Apr 10 '13 at 23:52
Sounds like the switch is installed between the router and the internet to mirror traffic to the Linux host. Are the link lights even active or is the internet connection completely down with the switch installed? – cpt_fink Apr 11 '13 at 1:15
First thing to do should be to make sure you still have connectivity to the Internet with the switch in between. Default configuration for the switch should be fine, assuming that no other ports on the switch are used. You should configure the mirror port only after you have confirmed this. – wookie919 Apr 11 '13 at 2:39
Have you enabled port mirroring for port 7 to 8? – tegbains Apr 11 '13 at 4:27
up vote 4 down vote accepted

You comment about your router using an RJ-11 connector makes me think that it's an ADSL router. If that's so, you can't do this with an ethernet switch; ADSL cells are not ethernet frames, and the switch will not therefore mirror them to the mirror port.

I don't know if the voltages involved are substantially different, but if they are, there's a danger that you can damage the equipment, connecting it as you have.

share|improve this answer
@MadHatter Very interesting! How would you sniff the traffic? Buy a real network tap? – Sandra Apr 11 '13 at 11:31
If, by a "real network tap", you mean a commercial ethernet sniffer, then no, that still won't help. You'd need some kind of transparent in-line ATM traffic analyzer. I don't even know if they exist, though I presume they do. – MadHatter Apr 11 '13 at 11:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.