RE: taps What Brand and Where in network

[Richard Bejtlich <richard_bejtlich () yahoo com>]

Two comments on this thread:

Ron, are you using Intrusion's 10/100 Ethernet
single-output product?  Did you know that if the
aggregate bandwidth pushed by both transmitters
exceeds 100 Mbps, you're dropping packets?  I asked
the Intrusion engineers about this; their reply: "Oh."
 If you paid $100-150 for the Intrusion tap I doubt it
can buffer traffic like the new NetOptics Aggregator
Tap can.

Michael, how does your homebrew tap handle signal
regeneration?

People pay money for taps because they regenerate the
signal to be passed to the monitoring platform.  If
you unplug the power from a tap, it keeps passing
packets.  It won't send packets out to the monitoring
interfaces though.

Incidentally, taps handle power loss differently. 
Consider a test involving pinging an Internet host
from a system behind a tap.  When my Finisar tap loses
power, it consistently drops 3 packets before passing
them again.  When my NetOptics tap loses power, it
keeps right on passing packets.   

For both, loss of power means loss of monitoring
capability.  NetOptics handles this by packaging its
taps with two power inputs; Finisar provides one.

Sincerely,

Richard
http://www.taosecurity.com

PS:  I don't work for either company.  :)

__________________________________
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
http://hotjobs.sweepstakes.yahoo.com/signingbonus


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users