IDS mailing list archives
Re: port bonding and taps
From: "Sam f. Stover" <sstover () iwc sytexinc com>
Date: Thu, 2 Oct 2003 11:31:37 -0400
On Thursday, October 2, 2003, at 10:57 AM, Jeffrey.Stebelton () bisys com wrote:
What we have done is to set a 10 Mb Ethernet hub up near the tap and run both tap ports into it. We then plug whatever sniffers you want into thehub and you will see both sides of the traffic.
I think this works in a very small environment, but doesn't scale too well. Since the tap ports aren't participating in an Ethernet network the way a normal host does, there is a real opportunity for collisions. Especially when using a hub which is real dumb about things like this.
It's all about your budget and needs, but for a little more money you can get a Cisco 2900 (or whatever vendor you prefer) which can mirror both Tx and Rx ports to a common port without the risk of collision.
SfS ____ S.f.Stover sstover () iwc sytexinc com
Attachment:
PGP.sig
Description:
Current thread:
- port bonding and taps John Flynn (Oct 02)
- Re: port bonding and taps Bamm Visscher (Oct 02)
- <Possible follow-ups>
- Re: port bonding and taps Jeffrey . Stebelton (Oct 02)
- Re: port bonding and taps Michael Stone (Oct 02)
- Re: port bonding and taps Sam f. Stover (Oct 02)
- Re: port bonding and taps Bamm Visscher (Oct 06)
- RE: port bonding and taps PPowenski (Oct 02)
- Re: port bonding and taps Sam f. Stover (Oct 02)
- Re: port bonding and taps Bennett Todd (Oct 06)
- Re: port bonding and taps Sam f. Stover (Oct 06)
- Re: port bonding and taps Bennett Todd (Oct 06)
- Re: port bonding and taps Sam f. Stover (Oct 06)
- Re: port bonding and taps Sam f. Stover (Oct 02)