Can a device on one subnet see traffic from another subnet (shared switch/router/WAN)?

[jazzop]

I was under the impression that under normal circumstances, two subnets cannot see each other. However, I have an unusual scenario where I want to be sure that my subnets are truly invisible...

Shared architecture: Cable Modem-->firewall/router-->switch-->to subnets

Subnet 1: 192.168.0.x/24, an Active Directory domain supporting my home business, 100% wired ethernet to the switch. DNS server on the ADDC. Assigned IPs; no DHCP server.

Subnet 2: 192.168.1.x/24, all other household users connecting through a WAP, which is wired to the same switch as above. OpenDNS. Assigned IPs, no DHCP server.

Here's the rub: I have been approached by a market research company to plug in a physical device that collects data on internet usage. The financial compensation is quite high--enough for me to actually consider it, and that's saying a lot. This company is reputable, but this device is very new-to-market, so there is nothing to Google about it. Regardless of what assurances they give me, I want to be sure that I can make my domain (Subnet 1) completely invisible to this device (on Subnet 2)*. That includes any traffic passing through the switch or router.

Since the inner workings of this device are a secret, I want to be sure that it cannot even detect my other subnet, sniff packets, etc. Any advice?

*There is a good chance this thing won't work anyway, as it probably expects to find a DHCP server and for a wide range of firewall ports to be open, neither of which I have.

 

[techgeek]

It's kind of hard to say exactly without knowing more about the hardware. Does it need to be configured to work on the network? Meaning does it get an IP address, or does it just monitor traffic. Does the traffic pass through it? Or is it attached to the switch like any end-point device. Meaning does the traffic have to pass through it to get to your computers and visa versa?

 

[bicycle_repair_man]

Without knowing what exactly this device does and how, it's difficult to suggest something. If this market research business can't tell you how their device works then I'd hand it back to them.

This is just my opinion, but the other household users have a right to know what you're doing, especially those who are less technically-literate. That's assuming you proceed of course.

My preferred option would be to turn subnet 2 into a VLAN and create a firewall rule to explicitly deny access to subnet 1, just for added peace of mind.

 

[bill001g]

If you are using a consumer grade switch that does not have vlans then you do not actually have 2 separate networks. The only reason is works is because you have manually assigned ip to everything but that is your only security if you would change the IP of a machine to the other ip range it would work because it is on the same lan.

If you use vlans to isolate then it is just a matter of placing the device between the firewall and the switch in a way that it only sees the single vlan. The device can not see data from other vlans if you have things configured correctly.

 

[Alabalcho]

Even if you have two subnets, if that device can set it's own netmask to /23 (instead of to /24), it will be able to see other devices (just as your router/firewall can see them). The fact that there's a switch in between won't stop communication.

OTOH - for this device to do it's research, it should be able to "sniff" the whole traffic, and unless you have a very fancy switch, that device will see nothing but it's own traffic.

Last option: What if this device plugs between the modem and the router?