Re: Use of Taps for IDS

From: roy lo (roylo@sr2c.com)
Date: 02/28/02


Date: Thu, 28 Feb 2002 09:29:10 -0800
From: roy lo <roylo@sr2c.com>
To: "'focus-ids@securityfocus.com '" <focus-ids@securityfocus.com>

No, not all switch has port mirroring.
(forwards packets to a given port based on the packet's address = port
mirroring)

Technically speaking, switches doesn't necessarily have functions such
port mirroring. And alot of those cheaper ones don't.

so it is like:
Black Horse = Horse
Horse != Black Horse

Greg Shipley wrote:
> On Thu, 28 Feb 2002, Reidy, Patrick wrote:
>
>
>>A switching hub (short for port-switching hub) is a device that forwards
>>packets to a given port based on the packet's address. Unlike normal hubs
>>that rebroadcast all packets to all ports. Since switching hubs forward each
>>packet only to the needed port, they are a lot faster. They work on the
>>network address (ip) and not the mac address (like a switch).
>>
>
> Uh, yeah, that's just a switch, no?
>
> -Greg
>
>