Ethernet switch with mirror of 1 port to 2

Please, advice model of switch (from 5 ports) and mirror setup. Switch should work as hub, i.e I need two ports for traffic registration.
I prefer mikrotik, but any other could be used (may be except Cisco).
I have some possible models (Huawei s2700, Huawei s2309, mikrotik as-326-24g, linksys 318, linksys 326, trendnet te-100-f5), but don't have setup for these devices.
LVL 41
als315Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Mal OsborneAlpha GeekCommented:
I assume this is for running Wireshark or similar, and sniffing packets?

I keep an old 10/100 hub, makes this task MUCH simpler. 10/100 hubs are long out of production and pretty rare, but you can probably  get one on cheap on Ebay. Small enough to keep in your laptop bag.

Something like this maybe:

https://www.ebay.com/itm/Netgear-6-Port-10-100-Mbps-Dual-Speed-Hub-DS106/292637985506?epid=74146687&hash=item4422954ae2:g:oEcAAOSws-tbBDi2:rk:1:pf:0

https://www.ebay.com/itm/Netgear-DS104-4-Port-10-100-Dual-Speed-Hub-with-Uplink-Button/153179593072?hash=item23aa371970:g:g44AAOSwPXdbmsut:rk:17:pf:0
als315Author Commented:
The aim is correct, but I need this device for customer and it should be new one.
CompProbSolvCommented:
You can set up promiscuous mode on many managed switches that should do the trick.  On the other hand, I'd go with Mal's advice and just use a hub.
SolarWinds® VoIP and Network Quality Manager(VNQM)

WAN and VoIP monitoring tools that can help with troubleshooting via an intuitive web interface. Review quality of service data, including jitter, latency, packet loss, and MOS. Troubleshoot call performance and correlate call issues with WAN performance for Cisco and Avaya calls

als315Author Commented:
@CompProbSolv: can you advice available model (not discontinued product) and configuration steps?
CompProbSolvCommented:
For a managed switch?  No... most any should do.  Check the manual and see about setting up promiscuous mode.

For a hub?  No.  I'd give up the requirement that it be a new product and find a used one.  Better yet, get two so that you have a backup.

Switches and hubs tend to be very reliable.  I have far less of a problem with one being used vs. new than with other items.

What is the long-term need here?

"but don't have setup for these devices": have you done a simple search for the manuals online?  For example, I found the following on LinkSys:

http://downloads.linksys.com/downloads/userguide/MAN_LGS308_LGS318_LGS326_LGS308P_LGS318P_LGS326P_8820-01844_RevC00_EN.pdf

Take a look at page 206.  They refer to it as Port Mirroring.
als315Author Commented:
I see many samples (in this manual also) how to mirror to one port, but can't find direct mention of mirroring to 2 ports.
I hope here is anybody who have such device and can confirm it.
nociSoftware EngineerCommented:
No switch i know of support mirroring to two ports. (sending data back from mirrored ports , although i never tried that...)
portmirroring is meant for eavesdropping on another line and can cause packet loss to the target port of a mirrored port.
(As both up & down link can send to the target, if both run > half line capacity it can overflow the target port).

"Hub" are not built anymore AFAIK. (And are limited to 100Mbps Half Duplex anyway;  https://en.wikipedia.org/wiki/Ethernet_hub).
A hub basicly is a piece of wire, where each receive line is connected to all other ports transmit lines.
A switch is a small computer receiving and forwarding packets, the extra overhead of searching for that target port is offset by the not receiving of data on endpoints that don't need it.

There is a trick to make a switch broadcast like a hub. It does so when it doesn't know the MAC address of a target.
So send with a different MAC from the mac you need to receive the data. (This method is used by Microsoft Clusters) exactly for this reason.
The MAC address of the cluster IP is never used on data transmissions.
als315Author Commented:
@noci: Thank for detailed info :). I have many years experience in this field. Some expensive switches like Huawei S5700 have confirmed ability to mirror one port to more then one:
S5700
nociSoftware EngineerCommented:
Nice to know thanks for Huawei info.
I forgot to tell that the interface on the receiving system must be in Promiscouos mode. (although that must be obvious to receive ANY mac address).
als315Author Commented:
I'm waiting for replies from owners of these models:
Huawei s2700, Huawei s2309, mikrotik css-326-24g, linksys 318, linksys 326
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Switches / Hubs

From novice to tech pro — start learning today.