Topic: Data Packet Analyzer?

[TexasTechnician]

I'm looking for a utility that I can use to determine the IP address of a computer that has one or more print jobs que'd up for a particular printer.

Here is the scenario: I had a printer that was caught in some sort of a loop the second I connected the network cable. The printer had been out of service for a few days due to a mechanical failure. Once the problem was repaired the IP address was being hit hard with a print job that over loaded the print que buffer in the printer causing it to stay in a "Warming Up" condition forever.

I knew it was a print job that was initiated from a computer while the printer was off line but I didn't know which computer. We used Wire Shark and were able to pin point the IP address of the computer. The problem was that we had to disconnect the printer, set the IP address of the printer to the pc that we were testing with, then run Wire Shark to locate the offending computer. It worked but the down time was more than I would like.

I'm hoping there is a utility that I can deploy in a manner that acts kind of "in the middle". Meaning I can trap, or sniff, the packets without having to take the printer off line reducing the down time.

[MacGyver]

Wireshark, formerly Ethereal.  It's a free download.  I haven't used the current version, but have always had good luck with it in the past.  The hardest part now days is finding a true hub that has no switching capabilities.

http://www.wireshark.org/

[telemarv]

Many switches have the capability of "port mirroring", which would allow another device to receive all of the activity directed to the port you want watch on the switch.

Alternately if you can find one is to put a hub in line with the port and thus giving you access to the port in question while keeping it on-line.

[Kumba]

Wireshark running on a Laptop with a supported NIC and a dumb hub and you are set. I use wireshark all the time when I am debugging SIP carriers and networks. It's so much easier to just send them a capture of the SIP messaging then argue about what is going on.

[TexasTechnician]

Thanks guys. I never thought of using a hub in line.

[MacGyver]

Wireshark running on a Laptop with a supported NIC and a dumb hub and you are set.

That's my recipe, and Best Buy still sells a small dumb hub.

[tonyburkhart]

Wireshark running on a Laptop with a supported NIC and a dumb hub and you are set.

That's my recipe, and Best Buy still sells a small dumb hub.

Another vote for wireshark and a hub. Amazon and eBay are littered with em and they are worth their weight in gold

http://www.amazon.com/Netgear-EN104TP-4-Port-Ethernet-Uplink/dp/B00000J4M9

[djhacker]

Yes, I am also a user of wireshark and a hub! Layer one you cannot beat it. It would be nice if there was a command to turn off layer 2 mac address learning on a cisco switch though, then you could just use that. 

[Kumba]

Try "no mac-address-table learning vlanX" and see if that does what you want.

[MacGyver]

Try "no mac-address-table learning vlanX" and see if that does what you want.

JAMES!!!!

Where ya been buddy?

[Kumba]

Living life. Bought a house. Thought it'd be fun to remodel. Then disappear for months on end with people wondering if the house ate you or not.

[MacGyver]

  It's your bank account you have to worry about it eating.

[Kumba]

It's your bank account you have to worry about it eating.

Too late. I done screwed up and thought I wanted a new kitchen.

[MacGyver]

It's your bank account you have to worry about it eating.

Too late. I done screwed up and thought I wanted a new kitchen.

You poor bastard.