Wireshark · Ethereal-users: Re: [Ethereal-users] Only Seeing Outgoing Packets

[Guy Harris <gharris@xxxxxxxxx>]

Ulf Lamping wrote:

> As you mention it, the wiki says: "Note that "dual-speed" hubs that 
> support both 10MBit and 100MBit ports might not send unicast traffic 
> between 10MBit and 100MBit ports; if so, you can only capture traffic 
> between hosts whose Ethernet interfaces are running at the same speed as 
> the Ethernet interface on the machine capturing traffic."

I've expanded that part of the HubReference page to give more detail, 
describing the scenario I outlined in an earlier message.

> The bridge between the two speeds seems to be a (bit of a) switch. I've 
> added your hub to the wiki and mentioned the bridge problems.

I'm assuming there are at least two types of dual-speed hubs - one type 
with *no* bridge between the speeds, which I assume means that a 10Mb/s 
host and a 100Mb/s host plugged into the hub can't communicate at all 
(so there's no traffic between them to capture), and one type with a 
switch between them (so that broadcast and multicast traffic are passed 
between the speeds, and unicast traffic is passed to the port to which 
it's being sent), which I assume means that a 10Mb/s host and a 100Mb/s 
host plugged into the hub can communicate, but another host plugged into 
the hub can only see one side of the conversation.

(Are there any dual-speed hubs that pass *all* traffic?  I could imagine 
a lot of 100Mb/s traffic flooding a 10Mb/s port in that case.)