Snort mailing list archives
Re: A question about taps
From: Richard Bejtlich <taosecurity () gmail com>
Date: Fri, 16 Sep 2005 10:35:56 -0400
Gary Brett wrote:
Just a quick question, I have in my possession a simple little plastic tap (basically a little adapter type thing that has 3 RJ48 ports on it, it is not a powered device just a little internally wired adapter). After testing it, it does exactly what a tap should do and outputs all traffic it receives on any of the 3 ports to all the other ports.
Hi Gary, I bet I have a device similar to that in front of me now. I bought it at Radio Shack to see how it worked. I still have the device in the box because it is worthless for most situations. (I should have returned it!) It's item 278-785, "Ethernet 10 Base-T Computer Network Cable Splitter." Radio Shack provides the wiring diagram. [0] A search for the part number reveals other people found it to be worthless too. Alternative solutions are listed here. [1] The problem with these systems is the lack of signal regeneration. Without power you will have a weaker signal. Over distance you will lose frames. I would not use anything like this in production. Even a powered hub is a better solution than this device. This unpowered splitter is essentially the same as the do-it-yourself "taps" that are unfortunately documented elsewhere. [2] Sincerely, Richard http://www.taosecurity.com [0] http://support.radioshack.com/support_supplies/doc66/66324.pdf [1] http://www.duxcw.com/digest/Reviews/Network/ats/index.html [2] http://www.snort.org/docs/tap/ ------------------------------------------------------- SF.Net email is sponsored by: Tame your development challenges with Apache's Geronimo App Server. Download it for free - -and be entered to win a 42" plasma tv or your very own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- A question about taps Brett, Gary (Sep 16)
- Re: A question about taps Ted Kaczmarek (Sep 16)
- Re: A question about taps Joel Esler (Sep 16)
- Re: A question about taps Eric Hines (Sep 16)
- Re: A question about taps Eric Hines (Sep 16)
- <Possible follow-ups>
- Re: A question about taps Richard Bejtlich (Sep 16)
- RE: A question about taps Brett, Gary (Sep 16)
- RE: A question about taps Eric Hines (Sep 16)