Hacker News Reader

Comment by purpleblue | Hacker News Reader

#1 is buy yourself a hub, NOT a switch. Consider understanding the difference between a hub vs a switch an important part of your initial networking education. Then learn how to sniff traffic, using things like WireShark, etc. You will learn a lot by watching all the traffic go back and forth, and then reference TCP/IP illustrated to understand the gist. Set up an HTTP server on a server, and then add a new computer to the network and then watch ARP, DNS, etc work their magic.

View on HN

IIRC, hubs aren't allowed in 1GbE or newer standards. Switches only.

So I'd advise don't waste money on a hub. As the sibling comment points out, port mirroring is a thing.

If you don't know anything about networking, how on earth are you going to learn about what port-mirroring is? You start off small, and work your way up from foundations. Hubs can be bought on eBay for cheap, and who cares if it's limited to 1Gbe? This is about learning.

> If you don't know anything about networking, how on earth are you going to learn about what port-mirroring is?

Through reading and understanding the fundamentals, just like we all had. The concept of port mirroring is super simple, I don’t remember any difficulties with that back then when I was a junior neteng. Nor did I need a hub to learn basics.

I've learned networking by doing but I haven't ever had a hub. When I tried to use Wireshark for the ~first time, and couldn't see traffic not for my host, I Googled that and got a good description. I haven't actually ever used port mirroring yet despite doing a lot of fun stuff with networking.

Lol? Where do you even find a working hub nowadays? I was gifted a 24 port one in 2012 but I forgot to take it with me two years later.

Any proper L2/L3 switch has mirroring so using a hub isn't mandatory.

One can do even simpler: install a Linux host and run tcpdump / wireshark to capture its own traffic on an interface. If you time the start of capturing with the moment you connect, you can see the DHCP, and probably DAD and DHCPv6 and/or SLAAC. Then mDNS, as well as high chance for HTTP/HTTPS. Running “sudo ntpdate time.apple.com” will give you a taste of NTP. (ARP/ND will be necessarily somewhere there as well).

There's nothing easier than hooking up 2 computers via ethernet to an isolated hub, and then watching the traffic go back and forth. There's no additional stuff to filter, you can just look at the packets which match exactly what is shown in TCP/IP Illustrated. From there, you can expand but I think the best experience is sniffing traffic between two computers on a hub to learn the fundamentals.

Two isolated computers won’t get you very far in today’s network. They might get the auto configured 169.254/16 addresses and link-local IPv6, and get some Bonjour traffic but that is about it. But those protocols are not in TCP/IP illustrated.

Back in the times of IPX and NetBEUI that was indeed a useful activity - connecting two Windows 3.11 computers with NetBEUI was a nice way to learn Ethernet LLC-2 (yes, the connection-oriented Ethernet layer protocol :-) as it allowed to nicely trigger the DLSW to learn it.

> #1 is buy yourself a hub, NOT a switch.

What?? You don’t have to buy a hub to learn networking. Switch with port mirroring works fine; a couple of VMs with packet sniffing on the interfaces work even better. I am not even sure if you still can buy a hub in 2024 - I’ve not seen any since like 2005? This advice is weird.

Reply on news.ycombinator.com