Main Site Documentation

A New Project I''m working on


#1

Hello People,

This is a new project I’m going to be doing as part of my final year at university , I just need to be sure that it’s possible I can do it.

The project is called “The Network Stephoscope” and it’s basic idea is to a create a micro Framework based device which has a network connection and can provide information on the packets which are being transferred, by means of a small LCD screen.

What I’d like to know is that is it possible for a micro framework device, to listen to packets that aren’t being addressed to itself.

Thanks guys


#2

Basically you are digging into raw packets and not needing for network stack.

To do this, you need to connect ENC28J60 over SPI. And then you will have access to raw network data. I recommend you use EMX based board because you will have a lot of data and you need a lot of RAM to buffer it.


#3

To “sniff” the packets, you need to be on the same wire - so plugged into a hub or a span port on a switch where the traffic is running. If you’re just plugged into a port on a switch you won’t see traffic not meant for you.

Your Ethernet chip needs to support Promiscious Mode - which means it will process packets that are not destined for its own mac address. That’s why it’s called sniffing.

You’ll be able to get a fair amount of data by looking at the wire - but you’ll soon run out of processing power or memory or both depending on how fast the packets are moving. Maybe you can watch a DSL connection, but you’ll struggle to sniff 10 Mb/s or 100 Mb/s if it goes full blast.

It all depends on what you want to monitor and display on your lcd. What did you have in mind?


#4

Things really depends on the speed the data packets will flow and if you don’t want to miss any.
Gus is right about the RAM requirements. However, I would advise maybe using the ChipworkX board. It’s a little more expensive, but really much faster than the EMX. You are really going to get a lot of data…

The ENC28J60 is promiscious mode capable, by clearing all bits inside the filter frame register (ERXFCON).

Have fun :smiley:


#5

Thanks a lot for the advice people it helps quite a bit.

Basically it’s going to have to display basic network information (gateway address, number of stations connected, number of packets per second being transferred)

I don’t mind spending the extra money on the ChipworkX board if it’s going to work better in the long run.