Re: Wiring a "read only" cable (Joe Pampel)

[Wynn Fenwick <wfenwick () entrenet com>]

Hi Guys,

Correct me if I'm wrong but this works for a hub only and not a switch.
Switches would get confused at the logical link layer, would they not,
since they would see the same frames on the incoming from the host as
were outgoing to the host?

I have also tried building the cable that has a schematic listed at
http://personal.ie.cuhk.edu.hk/~msng0/sniffing_cable/index.htm

While electrically the high-pass filter worked as expected, our Cisco
3500xl compensated for the attentuation, which was obviously off a bit
because the R of the cable may not have been accurate enough, or the C
value of the cap was not tolerant enough.

The host was able to transmit despite the presence of the cap on the Tx
wire.

W


Jay Flowers wrote:

No, this is neither a crossover cable, nor are pins 1 and 2 simply cut.

(I can easily see how colorblindness would make it difficult or
impossible
to see that the wire colors of the sniffer cable match the normal one,
not
the crossover one.)

This is a normal ethernet cable, with pins 1 and 2 shorted over to pins
3
and 6 on one side, normal wiring on the other.

I suspect this was done by cutting a small amount of insulation off of
pins
3 and 6, and soldering in pins 1 and 2, but I'm sure there are other
ways
to make the splice.

This is a pretty cool trick and looks like it will deal with the problem
of
just cutting the TX wires on 100baseT (which causes the link to go dead
and
you can't receive). I've not tried it, but it makes some sense to me why

this works, and I'll believe Josh that it does work.

At 08:23 AM 11/30/2001, Flowers, Jay wrote:
> So this is a crossover cable with pins 1 and 2 cut on the crossed side?

> Jay Flowers
> Integic Health Care
>
>
> -----Original Message-----
> From: Lists [mailto:lists () ironcomet com]
> Sent: Friday, November 30, 2001 6:19 AM
> To: Josh Oshiro
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Re: Wiring a "read only" cable (Joe Pampel)
>
> I use a simple cable on all of my sniffers. I have successfully used
this
> cable on Windows 2000 Pro and Server boxes when deploying Snort.
>
> Give it a shot.
>
> http://www.ironcomet.com/ethernet.shtml


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users