Reddit reviews NETGEAR 5-Port Gigabit Ethernet Smart Managed Plus Switch (GS105Ev2) - Desktop, and ProSAFE Limited Lifetime Protection

I use one of these running VMware ESXi with a pfSense VM that is the only VM that is bound to the WAN interface, the other port is a trunk port for multiple VLANs.

http://www.amazon.com/Shuttle-LGA1155-90-Watt-Barebone-XH61V/dp/B00BKV3BQ8/ref=sr_1_3?ie=UTF8&qid=1397853014&sr=8-3&keywords=shuttle

Initially I used this simple Netgear ProSafe switch that supports VLANs:

http://www.amazon.com/Netgear-ProSAFE-Gigabit-Switch-GS105Ev2/dp/B00HGLVZLY/ref=sr_1_1?ie=UTF8&qid=1397853096&sr=8-1&keywords=netgear+prosafe+105e

My network is much more complex now but thats a good start.

Disclaimer: Everything is backdoored now that the government can place gag orders on companies and force them to comply for "security." Is VMware backdoored or has tons of 0-days? Absolutely. Is that shuttle system? Absolutely. Is pfSense? Probably. Are the VMs running on it? Definitely because VMware is. Is that switch? Probably.

Security online no longer exists as long as governments are forcing companies to make vulnerable software and hardware.

>What quality of router is the Google Fiber Network Box equivalent to?

A potato.

Seriously though, if you wanted a user-friendly router/AP combo, you can put anything behind a switch with proper VLAN tags.

Get one of these and follow the instructions here.

Then you can put any router you want behind it. I recommend the AC86u.

I used this as a guide: https://superuser.com/questions/1148268/how-to-ditch-centurylink-fiber-modem

With a managed switch if you don't have a router that can do VLAN tagging.

> No, you can't drop it because you're passively monitoring it.

That's not true. The IPS can send RST packets to both endpoints and cause the connection to prematurely terminate, or ICMP unreachable for UDP.

You can also just use an older hub, but here are some affordable devices which support mirroring:

https://www.amazon.com/midBit-Technologies-LLC-10-100/dp/B00DY77HHK/

https://www.amazon.com/Dualcomm-DCSW-1005-Powered-Ethernet-Mirroring/dp/B002BSF112/

https://www.amazon.com/NETGEAR-GS105Ev2-Ethernet-Lifetime-Replacement/dp/B00HGLVZLY/

https://www.amazon.com/TP-Link-Gigabit-Ethernet-Managed-TL-SG105E/dp/B00N0OHEMA/

That switch probably doesn't support VLANs, but if you're looking for something small with basic VLAN support these are decent: https://www.amazon.com/NETGEAR-GS105Ev2-Ethernet-Lifetime-Replacement/dp/B00HGLVZLY

Pretty much any entry level managed switch will do.

TPlink, netgear, and trendnet all have entry level web managed switches that do VLANs for around ~30.

https://www.amazon.com/gp/aw/d/B00HGLVZLY/ref=mp_s_a_1_1?ie=UTF8&qid=1496598384&sr=8-1&pi=AC_SX236_SY340_QL65&keywords=netgear+vlan&dpPl=1&dpID=41ClMxcjRoL&ref=plSrch

What kind of router do you have?

You could try putting in an inexpensive network mirror between the modem and the router: https://www.amazon.com/NETGEAR-Gigabit-Lifetime-Protection-GS105Ev2/dp/B00HGLVZLY/ref=pd_lpo_vtph_147_bs_t_1?_encoding=UTF8&psc=1&refRID=ZFRPMPCN0RHPTBX2APKG

https://isc.sans.edu/forums/diary/Tap+Gigabit+Networks+on+the+Cheap/21775/

Use this in the middle: http://www.amazon.com/NETGEAR-ProSAFE-GS105Ev2-Gigabit-Managed/dp/B00HGLVZLY/

Cheap, durable, programmable (I believe I grabbed the right on). I usually use the GS-108P and GS-110TP so the smaller ones without power are pretty foreign to me.

If you want to stay with Pi - VLANs. There is a 5 port Netgear switch which will support VLANs - https://www.amazon.com/NETGEAR-GS105NA-Prosafe-5-Port-Gigabit/dp/B00HGLVZLY/ I've used this to run a firewall on a Pi.
The Banana Pi mentioned below looks interesting - I'll be taking a closer look at it. Or there's this -
https://www.amazon.com/QOTOM-Q190G4-S02-products-Barebone-J1900-Industrial/dp/B01KX9OU58/. This, or something very similar, was convered in an Ars Technica article on building your own router.

Use a very inexpensive switch with port mirror function?

You'd plug the receiver into the "mirror" port, and the sender into any other port.

Any traffic generated by the receiver will probably be dropped by the switch. You'd need to test to be sure.

edit: In one of your comments you said something about secure/insecure. If this is a security boundary, then don't use one of those switches. There's no reason to trust that it won't allow (re)configuration from either end

FYI, as other mentioned prevent creating a loop, these netgear switches have a loop prevention option that works good enough for a home setting.

As others have said, using a switch that supports port mirroring would be better.

This switch for $30 supports port mirroring.

https://www.amazon.com/dp/B00HGLVZLY/ref=cm_sw_r_cp_apa_.tUMAbG9HWS16

Your modem and router would be connected to the switch, but you would designate a port as your tap and set up port mirroring. Then you set your sniffer computers NIC in promiscuous mode and connect it to the port you set up as the mirror destination.

Here is how it works in detail:
https://youtu.be/kCSRgbEMkWs

I'm a big fan of netgear's GS105E for access switches. There's no PoE, but at $24 after rebate just buy an injector with what you save. The web management interface is sleek and doesn't have too large of a learning curve. Completely silent (fanless) and very small. Stick it in a corner and forget about it.
https://www.amazon.com/NETGEAR-ProSAFE-GS105Ev2-Gigabit-Managed/dp/B00HGLVZLY
Edit: obviously you can scale up to 108E etc if you need more ports.

https://www.amazon.com/midBit-Technologies-LLC-100-1000/dp/B0175EODCE/ref=sr_1_3?keywords=sharktap&qid=1557855694&s=gateway&sr=8-3

​

https://www.amazon.com/NETGEAR-Gigabit-Lifetime-Protection-GS105Ev2/dp/B00HGLVZLY/ref=sr_1_3?keywords=managed+switch&qid=1557857433&s=gateway&sr=8-3

https://www.amazon.com/gp/product/B00HGLVZLY/ref=oh_aui_search_detailpage?ie=UTF8&psc=1

This switch will let you tap 1000mb ethernet.
You will get other players IPs (at least in some games) but it may be difficult to determine who's is who's.

I would try to either run sufficient cables (with or without smurf tube) to the various locations or get managed switches. This will let you pass/trunk multiple vlans to each location to better control your network setup.

You can get managed switches from $26 for 5 ports.this one is actually unmanaged. Whoops.

From $50 for 5 ports, $60 for 8 ports.

If you want to over-achieve look at the MikroTik line and run 10Gbps to each floor.

Do you know which Ubiquiti router would accomplish this? Would the Ubiquiti Unifi Security Gateway be the cheapest option?

Would this managed switch work as well? It seems to be quite a bit cheaper than the USG.

Also, by this does it mean it's not possible with my current setup?

Thanks!

\^This. Unless you are hanging a L2 switch off one port of the router and everything plugged into that switch will be on the same vlan then you will need a managed switch that you can tag the vlans properly. You would then essentially need to make the port between the router and the switch a trunk/have multiple vlans.

This looks like it would help you configure vlans for your router.

https://kb.netgear.com/25724/VLAN-tagging-setup-for-Nighthawk-router

​

Here is a couple L2 Managed switches that would probably work just fine.

​

https://www.amazon.com/NETGEAR-Gigabit-Ethernet-Managed-Technical/dp/B01MYTIPG2/ref=sr_1_14?keywords=managed+switch&qid=1556827508&refinements=p_n_intended_use_browse-bin%3A9647499011&rnid=9647496011&s=pc&sr=1-14

​

https://www.amazon.com/NETGEAR-Gigabit-Lifetime-Protection-GS105Ev2/dp/B00HGLVZLY/ref=sr_1_3?keywords=managed+switch&qid=1556827508&refinements=p_n_intended_use_browse-bin%3A9647499011&rnid=9647496011&s=pc&sr=1-3

​

​

Alternatively a L3 switch would probably work too as it should route.

Wireless? Go wired.

I recommend Google Wifi Hub, connected to a Switch if you have more than one speaker.

I have my rear speakers connected to hub and switch. And luckily have ethernet wall plugs for the Playbar and sub under the TV. Same setup for bedroom, kitchen, and basement. Never had a single hiccup in sound.

This is the switch I use.. (maybe an 8 port for under TV if you have other devices like gaming systems. Wired is 1000x better.

NETGEAR 5-Port Gigabit Ethernet Smart Managed Plus Switch (GS105Ev2) - Desktop, and ProSAFE Lifetime Protection

https://www.amazon.com/dp/B00HGLVZLY/ref=cm_sw_r_cp_api_i_U4G0Cb6VX6PB6

SG-3100 and 4 to 8 port managed switch is still cheaper than this obsolete hardware.

SG-3100: https://store.netgate.com/SG-3100.aspx

5 port managed switch on amazon: www.amazon.com/NETGEAR-Gigabit-Lifetime-Protection-GS105Ev2/dp/B00HGLVZLY/r

A rack shelf: https://www.amazon.com/s?k=rack+shelf&i=electronics&ref=nb_sb_noss_1

Still cheaper, and you further the pfSense project with your purchase of the SG-3100

You can get a really cheap "smart" switch that can at least pass VLAN tags provided that your pfSense box is where they are defined. For example I have a few of these cheap Netgear switches on my network that can pass VLAN tags and thus you can assign different ports to different VLANs.

 

http://www.amazon.com/NETGEAR-ProSAFE-GS105Ev2-Gigabit-Managed/dp/B00HGLVZLY/ref=sr_1_1?ie=UTF8&qid=1458737569&sr=8-1&keywords=Netgear+Smart+plus

Yeah, I was thinking about doing the same. There’s a cheap Netgear managed switch that looks like it would do the trick, but for the same reason as you mentioned, I won’t be able to trace what device it’s coming from.

Do you do anything else to help trace activity and log the urls or domains visited by device? I don’t know if a WiFi sniffing solution is overkill/overcomplicated.