Snort mailing list archives

Re: Is it really a HUB?


From: Rich Adamson <radamson () routers com>
Date: Sat, 25 Oct 2003 14:23:33 -0600

On Fri, Oct 24, 2003 at 06:00:41PM -0700, Craig Paterson wrote:
I ran into exactly the same problem with cheap Linksys hubs which turned 
out to behave as switches. I can't speak for that particular 3Com, but 
I'm using a four-port Officeconnect as an IDS hub, and it works great.


Ensure they are not in fact "10/100 hubs". If so, they are actually made up
of a 100M hub + a 10M hub joined via a 2-port switch. The outcome of which
is that if you have (say) 3 100M Ethernet devices plugged into it, and 1 10M
device, then the 3 100M devices can "see" each others traffic (like a hub
allows) - but they cannot see the 10M traffic.

i.e. check you Ethernet device settings and ensure they are identical - same
speed and same duplex. Then see if it starts acting like a hub.

And, the exact same response can be seen from lots of not-so-cheap hubs
as well. I've got a 24 port 3Com Dual Speed Superstack II that does it,
just like an old Netgear 4-port dual-speed "hub". Get caught on it fairly
regularily. :(

Rich




-------------------------------------------------------
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is doing for the Open
Source Community?  Make a contribution, and help us add new
features and functionality. Click here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: