Snort mailing list archives
Re: Looking for good hub
From: Rich Adamson <radamson () routers com>
Date: Tue, 28 Sep 2004 02:28:47 -0600
Can anybody suggest a good hub to sniff with? I have found out the some of the "hubs" are just cheap switchs with very small arp cache. I need a least 4 ports. I had been using the one from HP but, they stopped making them. BTW the linksys hubs are switchs.*ALL* 10/100 dual-speed hubs must have some switching behavior, no matter who makes it. It's physically impossible to be dual speed and not switch. If you think about passively repeating all traffic from a 100mbit segment into a10-mbitsegment.. You'll be speed limited by the 10mbit segment, thus you'll be relegated to being a 10mbit hub not a dual speed. Some dual-speed hubs behave like a 10mbit hub and a 100mbit hub connected by a two-port switch. Thus, if all ports are the same rate, it's a hub. However, these are not common anymore. It's much more common nowdays for "dual speed hubs" to be switches that don't support full-duplex and havesmallIf you want a pure passive hub, you're going to have to get a single-speed one, and these are becoming more and more rare. I keep an eye on liquidators like www.compgeeks.com. A while back they had a batch of old 3com 100mbit pure-passive single-speed hubs in and I got one for about$15.I also got a 10mbit hub at the same time. Although more costly, it's getting to the point where it's much easier to find a low-end 10/100 managed switch that has SPAN capabilities, such as the Cisco catalyst 2950 12pt (about $500 ) .I just got my hands on a Entrasys (Cabletron) ELS100-TXM 24 port 10/100 switch with 802.1q and port mirror capability for the whopping sum of $85.00 US (inc. fed ex ground shipping), and it will sniff all the traffic ya want, along with VLANS, CoS, QoS, Trunking, etc...
There's a reason why that specifc model is selling for that price. Its got some serious issues with the software that Entrasys has never addressed (and never will). I wouldn't install that switch in a production network even if it was free. Home use, maybe. ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Looking for good hub Bill Warren (Sep 27)
- Re: Looking for good hub Ty Bodell (Sep 27)
- Re: Looking for good hub Bill Warren (Sep 27)
- Re: Looking for good hub Bamm Visscher (Sep 27)
- Re: Looking for good hub Bill Warren (Sep 27)
- Re: Looking for good hub Matt Kettler (Sep 27)
- Re: Looking for good hub Bill Parker (Sep 27)
- Re: Looking for good hub Rich Adamson (Sep 28)
- Re: Looking for good hub Bill Parker (Sep 27)
- Re: Looking for good hub Glenn Forbes Fleming Larratt (Sep 27)
- <Possible follow-ups>
- RE: Looking for good hub Hague, Jeff (Sep 27)
- RE: Looking for good hub Shackleford, David M. (Sep 27)
- Re: Looking for good hub Ty Bodell (Sep 27)