Hub Reference
General
This page tells you which devices are hubs and which aren't.
As described in the CaptureSetup section (especially the CaptureSetup/Ethernet page), hubs can be useful for capturing. Unfortunately, many "hubs" are actually switches these days. Infos about (managable) switches can be found at the SwitchReference.
In general, if you find something with "full-duplex" in the device description, this is in fact a switch and not a hub. This is often the case with 100MBit Ethernet devices.
If you use a 10MBit hub, and it's stated to be a hub, it will be a hub.
Dual-speed hub warning
Note that "dual-speed" hubs that support both 10MBit and 100MBit ports might not send all unicast traffic between 10MBit and 100MBit ports; if so, you can only capture all traffic between hosts whose Ethernet interfaces are both running at the same speed as the Ethernet interface on the machine capturing traffic.
This means that if you have two hosts communicating at 100MBit/s, you will only be able to capture the traffic between them if the Ethernet interface of the machine capturing traffic is configured for 100MBit/s. Similarly, if you have two hosts communicating at 10MBit/s, you will only be able to capture the traffic between them if the Ethernet interface of the machine capturing traffic is configured for 10MBit/s, which is probably not the default configuration.
Some dual-speed hubs don't connect the 10MBit and 100MBit ports at all; with those hubs, two hosts whose Ethernet interfaces are running at different speeds will not be able to communicate, so there's no traffic between hosts of different speeds, and thus no traffic between them to capture.
Other dual-speed hubs have an internal switch connecting the 10MBit and 100 Mbit ports, so that only broadcast and multicast traffic, and unicast traffic to the host on a particular port, will be sent to that port if the traffic comes from a port with a different speed; with those hubs, two hosts whose Ethernet interfaces are running at different speeds will be able to communicate.
If you have a dual-speed hub with an internal switch, it means that if you have a 10MBit host communicating with a 100MBit host, you will only be able to see one direction of that traffic; you will only see the traffic from the 10MBit host if the interface of the machine capturing traffic is configured for 10Mbit/s, and you will only see the traffic from the 100 Mbit host if the interface of the machine capturing traffic is configured for 100MBit/s.
Some simplified Ethernet history
As with early 10MBit, the "line-based topology" (thick/thin "coax" Ethernet) was state of the art. The invention of hubs made the "star-based topology" (twisted pair, RJ45) widely accepted. Later, nearly at the "same time", both 100MBit and switches hit the market, so you could get 10MBit Switches and 100MBit Hubs (and really expensive 100MBit Switches for quite a while). Every device after that period will certainly be a 10/100MBit (or 100MBit only) switch, probably with some exceptions.
I don't know if the above is true for other networks than Ethernet, but I suspect it is.
REAL HUBS:
Devices that are real hubs; convenient for capturing.
Please add information to this list about models you know (including valuable info such as link speed and the like) ....
3Com
OfficeConnect Dual Speed Hub 16 (3C16751B) -- GeraldCombs
OfficeConnect Dual Speed Hub 8 (3C16750B) -- T. Eric Hong
Dynex
Seemingly manufactured for Best Buy (from looking at the box), these are currently available in B&M Best Buys (as of April, 2006).
DX-EHB4 - 4 Port 10 Mbps HUB - Byzantium
Edimax
Edimax still has a number of hubs available according to ![[WWW]](/wiki/ethereal/img/ethereal-www.gif){kind=small}
their "Fast Ethernet Switches / Hub" list:
ER-5398S
ER-5397P
ER-5390P is known to be working.
ER-5395P
Andreas Sikkema
Level One
FHU-0400TXDS 4port 10/100Mbps (Note: no internal bridge between 10 and 100 Mbps!) - UlfLamping
Linksys
EFAH05W (Grey Case) - DonMcLane
EFAH08W Version 2.0
NETGEAR
DS104 Dual Speed HUB - Jens Link
DS108 Dual Speed HUB - Jens Link
DS524 24-port 10/100 (bridging between 10 and 100 Mbps filters packets!) - reported by Simon Bradley
DS508 8-port 10/100 - part of the same family as the DS524, so it probably behaves like the DS524 - Guy Harris
DS516 16-port 10/100 - part of the same family as the DS524, so it probably behaves like the DS524 - Guy Harris
Hewlett-Packard
ProCurve 10Base-T Hub 8 (HP J4090A) -- Petr Vacha
FAKE HUBS:
Devices that claim to be hubs, but in fact are switches.
Please add information to this list about models you know (including valuable info such as link speed and the like) ....
Linksys
EFAH05W - Erkan Altan
EFAH08W - Erkan Altan
Version 3.0 ONLY. Steven Posnack noted the
differences.
EFAH16W (10/100 5-Port and 16-Port Workgroup Hubs including V2) - Erkan Altan
NH1005 V2 - Charles Dunkirk
I was not able to get a new hub matching this version to work for passive sniffing. -- Ryan Sommers
I cannot sniff this 'hub' either. After googling around, I am fairly sure this is a rebadged switch. This hub used to be under 'REAL HUBS' so I moved it down here and kept the comments and attributions -- Rick Hull
This is not a hub, the internals are made by a company called Kendin, the IC product number is KS8995, a 10/100 switch -- Trey Keifer
Allied Telesyn
AT-FH708E (Unmanaged Fast Ethernet Hub)
SMC
EZ5808DS (Unmanaged Fast Ethernet Hub) Todd Parker
ZIO
ESB550SW (10/100 5-port Switching Hub)
Genius KYE SYSTEM CORP
GS4080 Mini (10/100 8-port Hub)
Claims to be a HUB, but has an RTL8309SB chip inside, wich is a single-Chip 9-Port 10/100 Mbps SWITCH Controller