Re: [PEN-TEST] Datacenter Wiring

[c0ncept <c0ncept () HUSHMAIL COM>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I believe there was a thread on this several months ago on one of the
mailing lists ( I believe it was this one) and the conclusion was
that this would work for at 10mb, but a 100mb connection requires a
two way connection for negotiation.

As far as inserting a diode, my understanding was that the link had
to be two-way to enable the initial negotion to take place.
<disclaimer> I'm not a hardware expert, and i could be totaly
mistaken, if i am, please forgive my ignorance </disclaimer>.

However, if the two way communication is only required for the
initial link, I would imagine that it would be possible to install a
toggle switch on the wire the would break the circut as soon as the
connection was established.

- --c0ncept

- -----Original Message-----
From: Penetration Testers [mailto:PEN-TEST () SECURITYFOCUS COM]On
Behalf
Of Andre Delafontaine
Sent: Friday, October 20, 2000 10:31 AM
To: PEN-TEST () SECURITYFOCUS COM
Subject: Re: [PEN-TEST] Datacenter Wiring


JLJ wrote:
> The attached snooping device doesn't need to talk, only listen.  If
> it can be quiet, it need not reveal its MAC address, and hence not
> reveal its presence on the line.  I have read that old style AUI
> cards have a separate "transmit" pair that can be clipped...I am
> sure that a suitable device could be constructed, including
> wireless LAN equipment with me on the receiving end a few buildings
> away.


I had a talk with Marcus Ranum a while back on this exact topic with
NICs using TP.

My proposed method was to cut one of the sending wires, although this
only works with NICs that don't require a link on the send side,
although one could hook up the send wires to a different, unused hub
just to create a link signal.

His method was to insert a diode (the right way, whichever way that
is)
in one of the send wires so that the NIC still sees link but isn't
able
to send anything.

I'm trying to find some time to try this out and I'm more than
interested in getting feedback on other people's experiences, in
particular what happens on 100BT cards.


Andre
- --
             andre.delafontaine at echostar.com

  F20 DSS: BD75 66D9 5B2C 66CE 9158  BB27 B199 59CE D117 4E9F
   F16 RSA: F8 04 FE 50 02 B5 03 02  F6 87 C7 8D F9 2E B8 58

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBOfCPn6Wx/xKSVGzTEQJ5oQCdHVjb8pfz/oM8vkp9kRo9yOaoXHIAniRo
tZ5h5cMKdlF0U9KmVcIJgj6c
=8hyL
-----END PGP SIGNATURE-----