4 ms·

#1 is buy yourself a hub, NOT a switch. Consider understanding the difference between a hub vs a switch an important part of your initial networking education.

#1 is buy yourself a hub, NOT a switch. Consider understanding the difference between a hub vs a switch an important part of your initial networking education. Then learn how to sniff traffic, using things like WireShark, etc. You will learn a lot by watching all the traffic go back and forth, and then reference TCP/IP illustrated to understand the gist. Set up an HTTP server on a server, and then add a new computer to the network and then watch ARP, DNS, etc work their magic.

ay 3y ago
One can do even simpler: install a Linux host and run tcpdump / wireshark to capture its own traffic on an interface. If you time the start of capturing with the moment you connect, you can see the DHCP, and probably DAD and DHCPv6 and/or SLAAC. Then mDNS, as well as high chance for HTTP/HTTPS. Running “sudo ntpdate time.apple.com” will give you a taste of NTP. (ARP/ND will be necessarily somewhere there as well).
- purpleblue 3y ago
  There's nothing easier than hooking up 2 computers via ethernet to an isolated hub, and then watching the traffic go back and forth. There's no additional stuff to filter, you can just look at the packets which match exactly what is shown in TCP/IP Illustrated. From there, you can expand but I think the best experience is sniffing traffic between two computers on a hub to learn the fundamentals.
  - ay 3y ago
    Two isolated computers won’t get you very far in today’s network. They might get the auto configured 169.254/16 addresses and link-local IPv6, and get some Bonjour traffic but that is about it. But those protocols are not in TCP/IP illustrated. Back in the times of IPX and NetBEUI that was indeed a useful activity - connecting two Windows 3.11 computers with NetBEUI was a nice way to learn Ethernet LLC-2 (yes, the connection-oriented Ethernet layer protocol :-) as it allowed to nicely trigger the DLSW to learn it.
allarm 3y ago
> #1 is buy yourself a hub, NOT a switch. What?? You don’t have to buy a hub to learn networking. Switch with port mirroring works fine; a couple of VMs with packet sniffing on the interfaces work even better. I am not even sure if you still can buy a hub in 2024 - I’ve not seen any since like 2005? This advice is weird.
justsomehnguy 3y ago
Lol? Where do you even find a working hub nowadays? I was gifted a 24 port one in 2012 but I forgot to take it with me two years later. Any proper L2/L3 switch has mirroring so using a hub isn't mandatory.
BenjiWiebe 3y ago
IIRC, hubs aren't allowed in 1GbE or newer standards. Switches only. So I'd advise don't waste money on a hub. As the sibling comment points out, port mirroring is a thing.
- purpleblue 3y ago
  If you don't know anything about networking, how on earth are you going to learn about what port-mirroring is? You start off small, and work your way up from foundations. Hubs can be bought on eBay for cheap, and who cares if it's limited to 1Gbe? This is about learning.
  - BenjiWiebe 3y ago
    I've learned networking by doing but I haven't ever had a hub. When I tried to use Wireshark for the ~first time, and couldn't see traffic not for my host, I Googled that and got a good description. I haven't actually ever used port mirroring yet despite doing a lot of fun stuff with networking.
  - allarm 3y ago
    > If you don't know anything about networking, how on earth are you going to learn about what port-mirroring is? Through reading and understanding the fundamentals, just like we all had. The concept of port mirroring is super simple, I don’t remember any difficulties with that back then when I was a junior neteng. Nor did I need a hub to learn basics.

ay 3y ago

One can do even simpler: install a Linux host and run tcpdump / wireshark to capture its own traffic on an interface. If you time the start of capturing with the moment you connect, you can see the DHCP, and probably DAD and DHCPv6 and/or SLAAC. Then mDNS, as well as high chance for HTTP/HTTPS. Running “sudo ntpdate time.apple.com” will give you a taste of NTP. (ARP/ND will be necessarily somewhere there as well).

purpleblue 3y ago
There's nothing easier than hooking up 2 computers via ethernet to an isolated hub, and then watching the traffic go back and forth. There's no additional stuff to filter, you can just look at the packets which match exactly what is shown in TCP/IP Illustrated. From there, you can expand but I think the best experience is sniffing traffic between two computers on a hub to learn the fundamentals.
- ay 3y ago
  Two isolated computers won’t get you very far in today’s network. They might get the auto configured 169.254/16 addresses and link-local IPv6, and get some Bonjour traffic but that is about it. But those protocols are not in TCP/IP illustrated. Back in the times of IPX and NetBEUI that was indeed a useful activity - connecting two Windows 3.11 computers with NetBEUI was a nice way to learn Ethernet LLC-2 (yes, the connection-oriented Ethernet layer protocol :-) as it allowed to nicely trigger the DLSW to learn it.

allarm 3y ago

> #1 is buy yourself a hub, NOT a switch. What?? You don’t have to buy a hub to learn networking. Switch with port mirroring works fine; a couple of VMs with packet sniffing on the interfaces work even better. I am not even sure if you still can buy a hub in 2024 - I’ve not seen any since like 2005? This advice is weird.

justsomehnguy 3y ago

Lol? Where do you even find a working hub nowadays? I was gifted a 24 port one in 2012 but I forgot to take it with me two years later. Any proper L2/L3 switch has mirroring so using a hub isn't mandatory.

BenjiWiebe 3y ago

IIRC, hubs aren't allowed in 1GbE or newer standards. Switches only. So I'd advise don't waste money on a hub. As the sibling comment points out, port mirroring is a thing.

purpleblue 3y ago
If you don't know anything about networking, how on earth are you going to learn about what port-mirroring is? You start off small, and work your way up from foundations. Hubs can be bought on eBay for cheap, and who cares if it's limited to 1Gbe? This is about learning.
- BenjiWiebe 3y ago
  I've learned networking by doing but I haven't ever had a hub. When I tried to use Wireshark for the ~first time, and couldn't see traffic not for my host, I Googled that and got a good description. I haven't actually ever used port mirroring yet despite doing a lot of fun stuff with networking.
- allarm 3y ago
  > If you don't know anything about networking, how on earth are you going to learn about what port-mirroring is? Through reading and understanding the fundamentals, just like we all had. The concept of port mirroring is super simple, I don’t remember any difficulties with that back then when I was a junior neteng. Nor did I need a hub to learn basics.