Re: A question about taps

[Richard Bejtlich <taosecurity () gmail com>]

Gary Brett wrote:

> Just a quick question, I have in my possession a simple little plastic tap
> (basically a little adapter type thing that has 3 RJ48 ports on it, it is
> not a powered device just a little internally wired adapter). After testing
> it, it does exactly what a tap should do and outputs all traffic it receives
> on any of the 3 ports to all the other ports.

Hi Gary,

I bet I have a device similar to that in front of me now.  I bought it
at Radio Shack to see how it worked.  I still have the device in the
box because it is worthless for most situations. (I should have
returned it!)  It's item 278-785, "Ethernet 10 Base-T Computer Network
Cable Splitter."  Radio Shack provides the wiring diagram. [0]  A
search for the part number reveals other people found it to be
worthless too.

Alternative solutions are listed here. [1]   

The problem with these systems is the lack of signal regeneration. 
Without power you will have a weaker signal.  Over distance you will
lose frames.

I would not use anything like this in production.  Even a powered hub
is a better solution than this device.  This unpowered splitter is
essentially the same as the do-it-yourself "taps" that are
unfortunately documented elsewhere. [2]

Sincerely,

Richard
http://www.taosecurity.com

[0] http://support.radioshack.com/support_supplies/doc66/66324.pdf
[1] http://www.duxcw.com/digest/Reviews/Network/ats/index.html
[2] http://www.snort.org/docs/tap/


-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users