I loaded up an RPi with arch, popped a thumb drive on there and created some startup scripts. Once the RPi booted up it just performed a rolling packet monitor. Once I was alerted about a disruption I went and grabbed the thumb drive. I found a Modbus TCP driver bug.
What’s even better is I ended up ‘packaging’ it in an enclosure and was able to utilize it in a lot of scenarios. I’ve been using it over the past 2 years.
Edit: in the industrial world equipment like this is not in racks/server rooms. They are usually located in panels that have no external networking (security). When I ‘grabbed’ that means traveling to the site and literally taking the drive.
A rack by any other name . . . :-)
TBH I was thinking of not just the trad. IT server room racks but also of cramped radio comms "cupboards" by towers and of production circuit | industrial control access panels / locations in both indoor "warehouse" production and outdoor mineral processing circuits ..
Always handy to have a small known general purpose computer with ports, scripts, utilities, etc when you're tracking down the weird bug of the day.
However, for ultimate utility I think the next iteration of my packet scraper will be a dual NIC’d SBC so I don’t have to worry about hubs or ‘managed’ switches with port mirroring.