Re: [Ethereal-users] help

[Stef <stefmit@xxxxxxxxxxx>]

On May 1, 2004, at 10:19 AM, herzog@xxxxxxxx wrote:

> > > On Tue, 27 Apr 2004, james wrote:
> > I have a  1 ip phone connected to a 4  port ethernet adsl router to 
> > make
> > voip calls. My pc(loaded ethereal analyser) is connected to another 
> > port on
> > the same 4 port ethernet adsl router.
> >
> > Is this configuration right  to capture the protocol exchanged 
> > between my ip
> > phone and voip provider using my pc.
>
> No.  More than likely, those 4 ports on the broadband router are 
> switched,
> so your PC will not be able to see traffic which is not originated 
> from nor
> destined for your PC.
>
> What you will need to do it either buy a cheap hub and plug the PC, 
> the IP
> phone, and the router into it...or, buy an ethernet tap to put in-line
> between the IP phone and the router (would also require a second NIC in
> the PC if you which to maintain internet access from the PC while 
> sniffing
> traffic)...
>
>
> --
> Larry Herzog Jr.        "Do nothing out of selfish ambition or vain
> VROC #11489              conceit, but in humility consider others
> herzog@xxxxxxxx          better than yourselves." - Philippians 2:3

Before you spend any money, try - first - to set the port speed and 
half-duplex for the analyzer's NIC to be the same as the one negotiated 
between the IP phone (see if you can make it half-duplex, also) and the 
ADSL router/switch. I have seen one too many times these router with 
"switched" ports behaving like hubs, when the connected devices are on 
the same speed and duplex, and working in switched mode only when one 
is 10Mbps, and one 100Mbps, for example ...

... just a suggestion - cheap to try ;)

Stef