Using ShowEQ

[rramsey]

I have looked at the available HOWTO's but have been unsuccessful.

From my Cable modem I have a linksys 4 port router, with a 4 port hub. Both my EQ and ShowEQ box are on the hub.

The ip's are DHCP'd.. 192.168.1.104 and 108

Typically what I do is run EQ and then start showEQ after it...
I have tried hooking showeq to the mac address, ip address and next eq client, but all it does is sit there.

Any suggestions?

[high_jeeves]

if the router/hub is one device, this will not work. It isnt a hub, its a switch. You need 2 devices. Please search for "router" and all your questions will magically be answered..

--Jeeves

[Mr Guy]

I'll give you a hint. There are two searches you need to run.

One on "Linksys"

One on "iptables"

[Tucc]

The question is, can a linksys router be used with a switch and work, I've toyed with it, and so far, no joy.

[high_jeeves]

No! Switches dont work easily for packet sniffing.. they just dont! I've said it 100 times, I promise I'm not lying.. really.. I promise!

--Jeeves

[rramsey]

So I have scoured the sites and although there is a lot of information, whenever I got close I ended up with a dead end...

ISP-->Linksys Router--->Linksys Hub--> 2 PCs (EQ & ShowEQ)

DHCP gives EQ 192.168.1.104 and ShowEQ 108.

Seeing how everyone here is more than willing say "do searches to find our answer" and not address the answer directly.

1. What tools can I use to diagnose the problem. There were a lotof reverences to dumptcp but that doesn't seem to be on my installation of RH7.2

2. Is there anything within the program that can detail any information, if im even getting past first base.

3. Is there anyone out there with a LInksys setup that has overcome issues that I should be aware of?

4. I understand networking fundamentals and the reasoning why a switched network would not be good over a hubb'd one in this respect. Is there something I could send from my EQ machine that will conclusively tell me that my RH installation is correct?

[high_jeeves]

Clearly, the searching advice is still valid, it just isnt being followed. Search for "linksys", and you will readily find that linksys "hubs" are actually switches (yes, they are marked as hubs. no, they do not broadcast traffic, they are switched.)

You need to go buy a real hub (most netgear, d-link, 3com hubs work) or use your linux box as a gateway. Search the forums (really search this time) for specific model numbers of working hubs.

--Jeeves

[Tucc]

I got news for you Jeeves, if you do searches for Linksys, you get a bunch of threads about doing searches for linksys.

[Dedpoet]

Search for "netgear" then go buy a DS104 from Best Buy for $30. Drop kick your Linksys out the window, use it for scuba weight, drop test it from a significant height, see how far you can throw it, run it over with your car, etc.

[Mr Guy]

Or, search for iptables.

Set up your linux box (physically) to connect to your switch twice (eth0, eth1). Set up your linux box (software) with iptables to forward packets from eth1 to eth0.

Set up your windows box to use your linux box as a gateway.

[Tucc]

I was avoiding using my linux box as a gateway, because then I also have to redo the windows networking =x. Also, I'm short on NIC's, oh well, guess I have more stuff to buy =x

[high_jeeves]

Mr. Guy:

Have you succesfully run this configuration? You are sending every packet through the switch 3 times in this case, I would think you would run into higher lag/packet loss situations (and a general throughput loss) by setting it up like this, which is why I dont recommend it.

Tucc:

Funny, I just searched for linksys, and on the first page of search results I saw 4 threads which state the problems with linksys hubs. I didnt look at all the threads, but 4 of the 6 I clicked on had the answer... I think this goes to the overall searching ability of users on this board... you have to actually click on this links in the search results page, maybe even a couple of them... As a side note, if people searched first, there wouldnt be so many threads saying "search for linksys"...

--Jeeves

[S_B_R]

Originally posted by high_jeeves
you have to actually click on this links in the search results page, maybe even a couple of them...

--Jeeves

Oooohhhh! Damn so that's the trick is it? Who'da thunk it??? :D

[Tucc]

But really, my point is, in the time you took to flame someone for not using the search feature, you could have told them the answer. I just dont like the internet holier then thou types is all ~_~

[Mr. Suspicious]

But really, my point is, in the time you took to flame someone for not using the search feature, you could have told them the answer. I just dont like the internet holier then thou types is all ~_~


And realy, our point is, in the time it took him to type the question and waste our time reading it in the first place, he could have found the answer easy and fast by doing a simple search on this forum.

Edit: You might learn something reading the preface-section of http://www.smoothwall.org/download/pdf/docs/0.9.9/doc.faq.pdf

[Yueh]

If they retyped the answer every time it was asked the board would be full of nothing but answers to the same 10 questions repeated thousands of times. It's a downward death spiral of information overload. It's not the same as a conversation where the answer evaporates the instant it's delivered.

[high_jeeves]

I just dont like the internet holier then thou types is all ~_~

And I dont like lazy people who expect me to do all their work for them, instead of taking 2 minutes of their own time. I guess we'll just have to say we are at an impasse...

--Jeeves

[devnul]

"If they retyped the answer every time it was asked the board would be full of nothing but answers to the same 10 questions repeated thousands of times. It's a downward death spiral of information overload."

as opposed to noise overload which is what endless threads by selfrighteous 'use the search engine you moron' ppl does

in any case if you don't have any idea about the problem it can be hard to guess to search for the name brand of your 'hub'

i don't know i would just have said "many 'hubs' are really switches and not hubs.. only a real hub will work"

i had this same issue over a year ago and i am a software engineer. if you aren't doing network admin for a living the fact that many manufacturers dont bother making dumb hubs anymore might have escaped you

i asked a net admin friend who thankfully just answered the question and didn't tell me to go use a search engine

i can see both sides of the equation but if the answer is shorter than the sermon why not give the answer? if the question annoys you, do like i do and don't waste your time answering at all

i mean really mom's advice was best.. if you don't have anything nice to say, don't say anything at all

mom was onto something

dn

[fgay trader]

Originally posted by devnul
in any case if you don't have any idea about the problem it can be hard to guess to search for the name brand of your 'hub'
How about a search on 'hub' then?



Originally posted by devnul
i don't know i would just have said "many 'hubs' are really switches and not hubs.. only a real hub will work"
This has been said countless times in countless threads.



Originally posted by devnul
i asked a net admin friend who thankfully just answered the question and didn't tell me to go use a search engine
I wonder what that engineer would have told you if you were the 1000th person that week asking him that same question.



Originally posted by devnul
if you don't have anything nice to say, don't say anything at all

You should start following your own advice.

[TweedleDee]

You can use a decent switch for your SEQ setup. i.e. Cisco Catalyst 3500 - all you need to do is set up SPAN with your gateway as source and your EQ box as destination. Thus all traffic going from your gateway will be forwarded out the port you set up SPAN monitoring on.

Switches aren't bad, they are prefferable to hubs - just not for SEQ ;)

[devnul]

"This has been said countless times in countless threads."

So answer it again. Or don't. Why antagonize people?

In any event this is unlikely. "Countless" is not a quantity that most databases supporting messageboards easily handle.

"I wonder what that engineer would have told you if you were the 1000th person that week asking him that same question. "

I don't know. Neither do you, since you haven't been asked 1000 times. Nor countless times. In fact no one ever specifically asked any specific person. Any response is by definition voluntary on the part of the responder.

Attacking a person for asking a question nevertheless DOES give information, but it is information about the person attacking. It's just not very flattering information.

dn

[high_jeeves]

How about this then devnul: The 6 or 7 people who answer questions here will all go away, and bow to your superior abilities.. oh, wait.. 18 posts? Never bothered to help anyone on here at all? about 30% of those posts criticizing the people who ACTUALLY help people here?

Get off your high horse.

When you come on here and spend your free time helping people with no payback at all, then the rest of us will shut up and start listening to you... until then, i think you will find that to date, you are a far less productive member of these boards than ANY of the people you criticize...

--Jeeves

[Haq-n-\]

Originally posted by TweedleDee
You can use a decent switch for your SEQ setup. i.e. Cisco Catalyst 3500 - all you need to do is set up SPAN with your gateway as source and your EQ box as destination. Thus all traffic going from your gateway will be forwarded out the port you set up SPAN monitoring on.

Switches aren't bad, they are prefferable to hubs - just not for SEQ ;)

I must admit I got a chuckle out of TweedleDee's post. That is a novel answer to a repetative question. Confuse the hell out of them! ;)

What are the chances that someone who is having trouble with a switch vs. hub issue would own a switch capable of spanning or know how to set it up? Let alone a Cisco Catalyst 3500.

You want to keep the SEQ user base down, that's the way to do it. Make them buy a $1K and up switch and learn to configure it. :D

Haq-n-\

[Gullork]

Why tell people to search instead of just answer the question?

Even if the answer is shorter than the 'sermon'?

Simple.

So that the next 10 times that same person has a question, they will search for it and not ask each of the same 10 questions that have already been asked by everyone else. The sermon might be longer for one question, but not for 10... and others may read this and search too instead of asking one of the other 10 common questions.

BTW, forgot to thank you guys for updating the save preferences and window positions!

[devnul]

"Never bothered to help anyone on here at all? about 30% of those posts criticizing the people who ACTUALLY help people here?

Get off your high horse."

Interesting that the Mr 'use the search engine you leech moron' High_Jeeves would accuse someone else of being on a high horse;)

Can we keep this from being personal?

Anyway I was criticizing for actively being unhelpful. Or did you miss that?

What I said was answer, or don't, if they ask for help. No need to attack someone for asking for help.

I follow my own advice.

"So that the next 10 times that same person has a question, they will search for it and not ask each of the same 10 questions that have already been asked by everyone else. The sermon might be longer for one question, but not for 10... and others may read this and search too instead of asking one of the other 10 common questions."

Actually this is the problem.

If someone actually DOES a search its so clutterred with posts saying "search you moron" that it is hard to find the real answer even if it's there. This making any sense?

dn

[high_jeeves]

If someone actually DOES a search its so clutterred with posts saying "search you moron" that it is hard to find the real answer even if it's there. This making any sense?


Well, but according to you, they shouldnt have to search, they should just post the same question over and over again, and the 5 or so people here who answer questions should fall over themselves to answer. So, this is really a non-issue according to you, anyway.. right?

Again, the solution here is simple, put up, or shut up.. if all you do around here is bitch about how other people answer questions, then you add alot more noise to these boards than anyone else. Atleast I point people in SOME direction (search, RTFM).. you just bitch about people.. I think if I leave these boards, people wont get the answers to their questions as quickly. If you leave the boards... well, nothing will happen... so, until the time when this is no longer true, just keep your opinions to yourself, and I will continue to HELP people, even if you dont appreciate my methods.

--Jeeves