Taps and 10/100 hubs

["Mike Lieberman" <Mike () netwright net>]

We are still working out how we will deploying our first IDS server. In all
the scenarios discussed, I didn't see the following:

Using the passive tap documented in http://www.snort.org/docs/tap/

Router <----------------[passive tap]------>switch
(10Mb,Half-Duplex)    [host, A, B, Host]
                            /   \
                           /     \
                          /       \
                         /         \
       (10Mb,Half-Duplex)           (10Mb,Half-Duplex)
                        \           /
                         \         /
                          \       /
                           \     /
                            \   /
                       Hub [4 PORT 10/100]
                    [example, NETGEAR DS104]
                              |
                              |
                           100Mb NIC
                             Snort

Netgear claims the hub has an "intelligent bridge automatically manages
network traffic..." since two half-duplex feeds are going into the hub and
the IDS is connected via a 100Mb NIC, doesn't that solve to a significant
extent the collission problem? Since we would only be monitoring the
bandwith coming to and from the router at 10Mb hald-duplex, I don't see
where we get into buffer issues.

Since I can't believe I have this right, what am I missing?
      



-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users