Snort mailing list archives
Re: Home-made ethernet TAP
From: Nicholas Bachmann <nbachmann () davison k12 mi us>
Date: Mon, 18 Aug 2003 22:59:26 -0400
Frank Knobbe wrote:
But if you use a swich, wouldn't the packets not be forwarded, since the L2 forwarding table of the switch wouldn't have the sensor's MAC, and the sensor wouldn't respond to an ARP request?On Mon, 2003-08-18 at 23:42, Ryan B. Lynch wrote:So here's the question: this took me ~20 minutes and $10 worth of parts to gin up. Why the heck do ethernet TAPs cost $400 and up? I've STFW'd and asked everyone I know who works with Ethernet, but no-one had ever heard of a working homebrew TAP like this. Am I just using the wrong keywords?Must be. Some time ago I played with a cable which ended up in the Snort FAQ as the Read-only cable. There is a similar RO cable with a capacitor inline (to scramble the send signal) on the Internet. AUI connectors with the send line cut is another. I also made a cable that split into two pairs, one for each direction (like your cable). The drawback is that you would need to combine the traffic flow. Using two NICs like you have would work, using a buffered switch might be another approach. A
Some cheap switches may then just act as a repeater, but you probably have to be careful with what you buy... right?
-- Regards, Nick Nicholas Bachmann, SSCP Technology Department Davison Community Schools ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Home-made ethernet TAP Ryan B. Lynch (Aug 18)
- Re: Home-made ethernet TAP Frank Knobbe (Aug 18)
- Re: Home-made ethernet TAP Nicholas Bachmann (Aug 19)
- Re: Home-made ethernet TAP Frank Knobbe (Aug 18)
- Re: Home-made ethernet TAP Nicholas Bachmann (Aug 19)
- Re: Home-made ethernet TAP Scot Scot (Aug 18)
- Re: Home-made ethernet TAP Frank Knobbe (Aug 19)
- Re: Home-made ethernet TAP Frank Knobbe (Aug 18)
- Re: Home-made ethernet TAP Frank Knobbe (Aug 19)
- Re: Home-made ethernet TAP Frank Knobbe (Aug 18)