I recently had a mac go haywire, taking half a minute or more to get www.google.com loaded. Getting its owner to give up the machine for repair was like pulling teeth - they were insisting that it must be something to do with the network, since so much had changed with the local configuration at about the same time their box went haywire.

I eventually set up a port mirror to a box that I could remote to so I could show that the mac was only irregularly getting packets onto the network. Demonstrating this faced an additional challenge: the latency of the remote desktop software I was using meant that I had to point to timestamps instead of just the moment the packet flashed up on the screen as my evidence.

This particular user was the reason this was so challenging this time around, but I would like to have a box that I can cart from desk to desk to use wireshark on my laptop at any station where I need it. 3com, cisco, netgear, etc. (ad nauseum), all make switches that can be configured for port mirroring, but in my case, the smaller, the better. For the sake of my sanity, I'll probably end up running it off a battery anyway.

If my laptop had two ethernet ports, this would be easy.

So, whaddya recommand for a device that requires 0 configuration at each powerup (though I'm fine with poking at it for a while to set it up initially.) Small, light, and cheap enough to get it past purchasing?



I bought a Cisco\Linksys SRW208 a few years ago fairly cheap.



Just get a small hub unless you need some of the fancy managed switch features such as vlans. But it may be hard to find a hub these days.

  • You beat me to it--or I typed too much! – jnaab Mar 9 '10 at 22:40
  • Exactly my issue. Hubs have become so passe that it seems that every hub on the market is being marketed as a "hub/switch" or something similar - they're actually switches. Come to think of it, the device I use at home falls into this category. – user37244 Mar 9 '10 at 22:52
  • Hubs were common back in the 10mbit days, but were rare in the 100mbit days (except so-called "dual-speed" hubs that could end up acting as switches in some situations, so wouldn't be recommended for someone that wants to capture another machine's unicast traffic). There's no such thing as a Gigabit hub (the GigE spec mandates switches), so if he ends up needing to look at a problem that only happens at gigabit rates, he'll still need a switch capable of port mirroring. – Spiff Mar 9 '10 at 22:55

If you want Gigabit, look at the Cisco/Linksys SLM2005 and SLM2008.


The SLM2005 has a street price of around $90. As just a 5-port switch, it's not very big. It contains lots of other management features in addition to port mirroring as well.


I've been searching for the same thing for home and mobile use. For mobile use, I chose this. Small, extremely portable, and very inexpensive: Price: $39.95. http://www.dual-comm.com/port-mirroring-LAN_switch.htm


I'm not aware of any readily available low-cost switches that provide port mirroring...

I suggest going "old school" and look on Ebay for an 4-port 10/100 Ethernet hub with a wall wart style power supply. You'll find lots of options and they are cheap--no one wants a hub any more (with good reason), but it seems that is exactly what you need!

I think it would be hard to find anything less expensive that would do the job.

  • I did the ebay search earlier and hit the same problem there as on retailers: the terms hub and switch seem to be used interchangeably, despite the clear distinction between what they do. – user37244 Mar 9 '10 at 22:54

Small,Portable, & does Port Mirroring ![alt text][1] http://www.dlink.com/products/?pid=DGS-3200-10 They Are MSRP $330 I love this switch


+1 for the dualcom. I have been testing their new 5 port gigabit enet switch (http://www.dual-comm.com/gigabit_port-mirroring-LAN_switch.htm).

It's USB powered, does power over ethernet pass though with a static port mirror setup. Works a treat for no frills plug and play sniffing of gigE poe powered devices such as 802.11n wifi APs. All for 100 USD$ on special.


As long as you're just jacking into the same local switched network, why not just use an arp poisoning attack? No hardware needed ;)

  • You don't want to modify/destroy the network for debugging purposes. – Thomas Weller Dec 30 '14 at 0:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.