RE: Found true hub

[Michael Miller <michael.miller () state co us>]

Having run into this problem with a load balanced webserver (not as an IDS
issue), we ran into the problems you mentioned with the linksys product.
3com's 'superstack 3 baseline 10/100 hub' is working well as a hub. (Again
with the caveat that it's got nothing but 100 mbit traffic moving across
it.)



-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Richard
Bejtlich
Sent: Friday, November 19, 2004 1:54 PM
To: snort-users () lists sourceforge net
Subject: RE: [Snort-users] Found true hub

John McCash wrote:

> Gullermo,
>        Ummm... from the writeup on that device on the CDW website:

> "Full connectivity among devices
> Each unit has a built-in self-learning bridge which provides the
> communications link between the 10 and 100Mbps network devices. The
> intelligent bridge automatically manages network traffic such that 100
> Mbps traffic does not unnecessarily crowd the 10Mbps network segment and
> 10Mbps traffic does not crowd the 100Mbps segment."

> Are you SURE that this isn't dropping some of the traffic that you're
> supposedly monitoring? It would not necessarily be obvious, especially
> over a slower link. I suppose that it's possible that this functionality
> only kicks in between 10 and 100 MB links, but the comment makes me
> suspicious nonetheless.
>                John

John and Gullermo,

Any device that is not a strict 10 Mbps or 100 Mbps device is not a
"true hub."  Any 10/100 Mbps device is a switch.

However, as I believe Bill originally posted, some 10/100 Mbps "hubs"
can act like "true hubs" when all connected devices are configured to
operate at the same speed -- either all at 10 Mbps or all at 100 Mbps.
 In my personal experience NetGear 10/100 Mbps hubs act as "true hubs"
but Linksys 10/100 Mbps "hubs" do not.

When researching chapter 3 for my book, I could not find any
small-scale strict 100 Mbps hubs.  [0]  Netgear does make 4 and 8 port
10 Mbps hubs.

Sincerely,

Richard
http://www.taosecurity.com

[0] http://www.taosecurity.com/books.html


-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users