[TriLUG] DHCP Problems and a Network Tap

[Pinkham]

Running tcpdump on the router should give you what you need, modulo any
hardware problems. Just dump to a file and analyze with wireshark on
your laptop, if that's what you're comfortable with.

Otherwise, the 750 series Mikrotik routers are about the cheapest way to
do port mirroring(~$45 for 100Mb, ~$60 for 1Gb) and you get a device
that's also useful for other things.  Similarly, picking up a 8 port
smart managed switch like the HP 1810-8g or Cisco SG200-08 for about
$100 gives you another toy you might find useful in the future as well
as solving your current problem.

On 2/16/14, 6:49 PM, Sean Alexandre wrote:
> I'm still debugging a sporadic DHCP problem. I've got a Debian firewall
> attached to my Time Warner cable modem (bridge mode). Sometimes it can complete
> the DHCP handshake and get an IP address. Other times it can't.
> 
> I've got a laptop that can always get one.
> 
> I've used wireshark to look at details, and have configured the firewall to
> give the same DHCPDISCOVER request as the laptop. Everything's identical,
> including MAC address, but I still don't get an DHCPOFFER back.
> 
> I want to put a network tap (or hub) on the connection coming from the firewall
> so I can see the actual traffic. Anybody know where I could get one? Ideally
> I'd like to find one locally or build one.  (I've already checked Intrex.)
> 
> I found these instructions, and may end up trying this:
> http://www.instructables.com/id/Make-a-Passive-Network-Tap/?ALLSTEPS
> 
> Anybody got a hub they want to get rid of (or router with a tap port)?
> 
> Or, any other suggetions?
>