Re: Can Snort report on 'late collisions'?

[Matt Kettler <mkettler () evi-inc com>]

At 03:37 PM 11/24/2003, Bryce Stenberg wrote:
> I've got a problem on our network where a router log shows it's ethernet
> connection is being reset often due to 'late collisions'. Searching google
> seemed to indicate a computer connected to it may have a faulty network card
> so I need to try to find the offending machine.

also keep in mind that often "late collisions" are usually due to a 
full-duplex-only adapter being attached to a passive HUB. They generally 
aren't the result of hardware failures, but it is possble.

Check the machines involved and see if they are all properly set for the 
right duplex.

Overly-long cables can also cause this problem.

> Is there anyway I could use snort (or winpcap) to detect/report on these
> late collisions? (even to only show if they are happening or not).  Or is it
> not possible as packets get discarded by the hardware?

hmm, not sure.. however I'd suspect if your router is complaining, they 
*are* happening.




-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users