How to sniff VOIP traffic on netgear dg834g ?

Netgear dg834g is an adsl router with 4-port-switch bridged with wi-fi
interface. I want to record my VOIP conversations by sniffing the traffic
to/from ATA connected to the switch. I think of connecting my laptop to
the switch and running erhereal on it to acheave this. How can I degrade
switch into hub? I read that I could overflow arp tables for the switch
to failover to hub(repeater) mode. Is there any more gracefull way from
within router itself? The box is running linux 2.4.17(ifconfig, brctl
commands available, and access to /proc).

Dmitri

On Sun, 01 Apr 2007 22:46:34 -0500, dmitri wrote:

>Netgear dg834g is an adsl router with 4-port-switch bridged with wi-fi
>interface. I want to record my VOIP conversations by sniffing the traffic
>to/from ATA connected to the switch. I think of connecting my laptop to
>the switch and running erhereal on it to acheave this. How can I degrade
>switch into hub? I read that I could overflow arp tables for the switch
>to failover to hub(repeater) mode. Is there any more gracefull way from
>within router itself? The box is running linux 2.4.17(ifconfig, brctl
>commands available, and access to /proc).

Why degrade the whole switch? Get a cheapo hub second hand and put it between
the ATA and the switch. With just the PC and the ATA on it you won't notice any
difference. But in any case how do you propose to play back a recorded session?

--

Regards

Dave Saville

NB Remove -nospam for good email address

Dave Saville wrote:
> On Sun, 01 Apr 2007 22:46:34 -0500, dmitri wrote:
>
>> Netgear dg834g is an adsl router with 4-port-switch bridged with wi-fi
>> interface. I want to record my VOIP conversations by sniffing the traffic
>> to/from ATA connected to the switch. I think of connecting my laptop to
>> the switch and running erhereal on it to acheave this. How can I degrade
>> switch into hub? I read that I could overflow arp tables for the switch
>> to failover to hub(repeater) mode. Is there any more gracefull way from
>> within router itself? The box is running linux 2.4.17(ifconfig, brctl
>> commands available, and access to /proc).
>
> Why degrade the whole switch? Get a cheapo hub second hand and put it between
> the ATA and the switch. With just the PC and the ATA on it you won't notice any
> difference. But in any case how do you propose to play back a recorded session?
>

Using Ethereal (or Wireshark as it's now called) you can generate an
audio file from the RTP packets easily.

I would also suggest trying to find a hub on ebay or somewhere but they
are getting harder to find, not helped by the way a lot of sellers on
there don't realise that a hub and a switch aren't the same thing!

Another alternative would be to buy a managed switch which has a
"monitor port" feature but this is probably too expensive for what you want.

cheers,
Paul.

In article <4610c97d$0$765$5a6aecb4@news.aaisp.net.uk>,
Paul Hayes <nomailforme@polog40.org.uk> wrote:
>Dave Saville wrote:
>> On Sun, 01 Apr 2007 22:46:34 -0500, dmitri wrote:
>>
>>> Netgear dg834g is an adsl router with 4-port-switch bridged with wi-fi
>>> interface. I want to record my VOIP conversations by sniffing the traffic
>>> to/from ATA connected to the switch. I think of connecting my laptop to
>>> the switch and running erhereal on it to acheave this. How can I degrade
>>> switch into hub? I read that I could overflow arp tables for the switch
>>> to failover to hub(repeater) mode. Is there any more gracefull way from
>>> within router itself? The box is running linux 2.4.17(ifconfig, brctl
>>> commands available, and access to /proc).
>>
>> Why degrade the whole switch? Get a cheapo hub second hand and put it between
>> the ATA and the switch. With just the PC and the ATA on it you won't
>notice any
>> difference. But in any case how do you propose to play back a recorded
>session?
>>
>
>Using Ethereal (or Wireshark as it's now called) you can generate an
>audio file from the RTP packets easily.
>
>I would also suggest trying to find a hub on ebay or somewhere but they
>are getting harder to find, not helped by the way a lot of sellers on
>there don't realise that a hub and a switch aren't the same thing!
>
>Another alternative would be to buy a managed switch which has a
>"monitor port" feature but this is probably too expensive for what you want.

Look up arp cache poisoning/spoofing.

Eg. http://en.wikipedia.org/wiki/ARP_spoofing

Gordon

>
>I would also suggest trying to find a hub on ebay or somewhere but they
>are getting harder to find, not helped by the way a lot of sellers on
>there don't realise that a hub and a switch aren't the same thing!

I've got an old Netgear 4 port ethernet HUB in my loft somewhere, with
power supply.
Would you like me to see if I can find it?

Regards
Steve

On Tue, 03 Apr 2007 14:08:37 +0100, SteveC wrote:


>>I would also suggest trying to find a hub on ebay or somewhere but they
>>are getting harder to find, not helped by the way a lot of sellers on
>>there don't realise that a hub and a switch aren't the same thing!
>
> I've got an old Netgear 4 port ethernet HUB in my loft somewhere, with
> power supply.
> Would you like me to see if I can find it?
>
> Regards
> Steve

Thank you Steve. I'll try to "soft-solve" that.

Regards,
Dmitri