Re: Tap and Hub

[Richard Bejtlich <taosecurity () gmail com>]

On Wed, Mar 24, 2010 at 12:55 PM, Crook, Parker <Parker_Crook () reyrey com> wrote:
> Typically speaking, vendors referring to hubs these days are referring to switches.  Just to double check and make 
> sure I hadn't missed the last few years, I asked one of our CCNPs and he gave me a funny look when I asked him about 
> gigabit hubs... so yeah, hubs only do 10 mb half-duplex.  Actually, here I started to brainstorm what a gigabit hub's 
> traffic would look like and, wow, talk about collision city...
>
> Anyways, yeah, go look at gigabit taps.  A tap is going to copy at line-speed, any traffic going through it to the 
> tapped ports and you won't have to worry about numerous issues such as collisions and exceeding the bandwidth of the 
> device.
>
> -Parker

Hello everyone,

For what it's worth, you can't purchase a Gigabit hub.

You can purchase a 10/100 Mbps "hub."  If you're fortunate enough to
get all of the connected interfaces to operate at 100 Mbps, and the
"hub" isn't really a switch, you can have half-duplex 100 Mbps
traffic.

For monitoring traffic between devices connected to the same switch,
SPAN is probably your best bet (as mentioned earlier).  Other options
include aggregator taps, matrix switches, and "data access switches"
(like Gigamon), but those are probably overkill.

Sincerely,

Richard

------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users