Snort mailing list archives

Re: Is it really a HUB?


From: Jason Haar <Jason.Haar () trimble co nz>
Date: Sun, 26 Oct 2003 08:05:04 +1300

On Fri, Oct 24, 2003 at 06:00:41PM -0700, Craig Paterson wrote:
I ran into exactly the same problem with cheap Linksys hubs which turned 
out to behave as switches. I can't speak for that particular 3Com, but 
I'm using a four-port Officeconnect as an IDS hub, and it works great.


Ensure they are not in fact "10/100 hubs". If so, they are actually made up
of a 100M hub + a 10M hub joined via a 2-port switch. The outcome of which
is that if you have (say) 3 100M Ethernet devices plugged into it, and 1 10M
device, then the 3 100M devices can "see" each others traffic (like a hub
allows) - but they cannot see the 10M traffic.

i.e. check you Ethernet device settings and ensure they are identical - same
speed and same duplex. Then see if it starts acting like a hub.

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is doing for the Open
Source Community?  Make a contribution, and help us add new
features and functionality. Click here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: