Setting up a Sniffer outside of the firewall

I am working with my ISP to determine why I'm getting RST packets when external devices are trying to connect to internal devices. I ran WireShark on the internal network but now the ISP would like me to get a packet capture between the incoming router and my firewall.

I don't have a hub or managed switch that I can use but I do have an available Windows 2003 server with two NICs. Is there a way to configure Windows 2003 so that the traffic will just flow through the two NICs without my having to assign them IP addresses. Basically, I just want it to act like a repeater so that I can monitor the traffic. TIA for any advice.

You will probably want to look into setting up a transparent bridge. I have configured one before, while setting up our content filter, but I am home sick, and won't be able to remember exactly how I did it without looking at the server.

Here's a good tutorial for setting up a linux transparent bridge with squid...

http://teklimbu.wordpress.com/2007/1...-squid-bridge/

Here's another tutorial but it's more intended for the purpose you are bringing about...

http://eatingsecurity.blogspot.com/2...-pcap-and.html

I ended up just buying a hub and running the connection through that and capturing with WireShark from my Win2003 machine.

I've not worked with Linux and needed the capture pretty quick. Had trouble finding someone who carried hubs in stock and even had one bozo try to sell me a switch because, "a hub and a switch are the same thing." BestBuy pulled me through, though, with an inexpensive 4-port hub.

You need to post the bozo's name of business and location - Public service and all that

The place is normally pretty good, I've bought other things from them. Let's just say that if you ever find yourself in Baton Rouge at Tim's computers, ask for someone other than Will.

hahahahahaha

Good answer StrixLa

Greenies for you :)

MLF

Haha. I have had those sorts of run-ins at mom and pop stores. Some of the people really know their stuff. While others... not so much. I have seen many "deer in headlights" stares.