How to use a network interface as read-only?
1
vote
1
answer
1564
views
I have a switch in my home lab that I want to run some experiments with, especially with regards to VLANs and some other protocols that I want to better understand. Now, this switch (a [TP-Link 5-port somewhat managed switch](https://www.tp-link.com/lk/business-networking/easy-smart-switch/tl-sg105e/)) allows for port mirroring.
This mirrored traffic I want to analyze on my computer with as little "new" traffic introduced from the monitoring machine as possible. How can I accomplish that?
I know already, that you have to put the NIC into promiscuous mode in order to receive packets not originally destined for my PC. As this is usually done by Wireshark itself, I don't have to worry about it.
However, I wanted to make sure to introduce as little "noise" on the port as possible, in order to really just look at the traffic generated on the other ports. I already found [this answer](https://unix.stackexchange.com/a/190779/193819) that suggests disabling all services running (like DHCP et al), which makes sense. But while this will reduce the noise by a lot, it probably won't be able to prevent ARP resolution or other kernel-based network interactions.
I also learned that there are protocols meant specifically for this purpose (like [Cisco's SPAN](https://community.cisco.com/t5/networking-documents/understanding-span-rspan-and-erspan/ta-p/3144951)) , but my switch doesn't have that ability.
So my question is: how can I use my network interface as read-only as it gets?
Asked by mh166
(113 rep)
Jun 15, 2021, 09:44 AM
Last activity: Jun 16, 2021, 01:20 PM
Last activity: Jun 16, 2021, 01:20 PM