Snort mailing list archives
Re: Is it really a HUB?
From: Darryl Luff <dluff () iitscdm com au>
Date: Wed, 29 Oct 2003 16:04:59 +1100
Kristofer T. Karas wrote:
Marc Quibell wrote:as long as one keeps one's box from transmittingany data, the hub/switch will not learn its MAC address, and should sendit everything.Actually, it will send it nothing at all....Thanks, but that doesn't really explain what is (or is not) going on. In particular, it still leaves questions in my head as to the ability of plugging several of these mini switches together to add ports. Since they are not configurable as to network address
...It works as you say. Except that if your station never transmits anything, the switch will not learn your MAC, and will flood all traffic addressed TO YOU out all ports. Traffic addressed to other MAC's will go through the bridging process you described, and so wont normally be seen by your station unless they're unknown MAC's, broadcasts, etc.
Switches can continue to operate in a LAN where the number of unique MAC's is larger than their forwarding table capacity. When new MAC's are discovered either older ones are dropped out of the table, or the complete table is cleared and learning starts again. So they will continue to operate, but there will be more packet flooding than necessary. And of course the forwarding table only needs enough capacity to hold the MAC's for the local LAN/VLAN, not the whole network.
------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Is it really a HUB? Petriz, Pablo (Oct 24)
- Re: Is it really a HUB? Craig Paterson (Oct 24)
- Re: Is it really a HUB? Jason Haar (Oct 25)
- Re: Is it really a HUB? Rich Adamson (Oct 25)
- Re: Is it really a HUB? Mike Cojocea (Oct 27)
- Re: Is it really a HUB? Jason Haar (Oct 25)
- Re: Is it really a HUB? Kristofer T. Karas (Oct 27)
- <Possible follow-ups>
- Re: Is it really a HUB? Marc Quibell (Oct 28)
- Re: Is it really a HUB? Kristofer T. Karas (Oct 28)
- Re: Is it really a HUB? Darryl Luff (Oct 28)
- Re: Is it really a HUB? Kristofer T. Karas (Oct 29)
- Re: Is it really a HUB? Kristofer T. Karas (Oct 28)
- Re: Is it really a HUB? Craig Paterson (Oct 24)
- Re: Is it really a HUB? Marc Quibell (Oct 28)
- RE: Is it really a HUB? Potts, Ross A. (Oct 29)
- Re: Is it really a HUB? Petriz, Pablo (Nov 26)
- Re: Is it really a HUB? Matt Kettler (Nov 26)
- Re: Is it really a HUB? kenw (Nov 27)
- Re: Is it really a HUB? Matt Kettler (Nov 28)
- Re: Is it really a HUB? kenw (Nov 28)
- Re: Is it really a HUB? Matt Kettler (Nov 28)
- Re: Is it really a HUB? kenw (Nov 28)
- Re: Is it really a HUB? Matt Kettler (Nov 26)