Re: Use of Taps for IDS

From: roy lo (roylo@sr2c.com)
Date: 02/28/02


Date: Thu, 28 Feb 2002 09:29:10 -0800
From: roy lo <roylo@sr2c.com>
To: "'focus-ids@securityfocus.com '" <focus-ids@securityfocus.com>

No, not all switch has port mirroring.
(forwards packets to a given port based on the packet's address = port
mirroring)

Technically speaking, switches doesn't necessarily have functions such
port mirroring. And alot of those cheaper ones don't.

so it is like:
Black Horse = Horse
Horse != Black Horse

Greg Shipley wrote:
> On Thu, 28 Feb 2002, Reidy, Patrick wrote:
>
>
>>A switching hub (short for port-switching hub) is a device that forwards
>>packets to a given port based on the packet's address. Unlike normal hubs
>>that rebroadcast all packets to all ports. Since switching hubs forward each
>>packet only to the needed port, they are a lot faster. They work on the
>>network address (ip) and not the mac address (like a switch).
>>
>
> Uh, yeah, that's just a switch, no?
>
> -Greg
>
>



Relevant Pages

  • Re: Experts Help Please Settle Arguement - Hub or Switch if ISP offers several IPs
    ... you don't use a switch in this kind of arrangement. ... >Switches an algorithim for routing packets at Layer 2. ... >response is sent back to the hub from the right destination node. ... Note that I show an 8 port hub in the top drawing instead of a switch. ...
    (alt.internet.wireless)
  • Re: Cat 2924
    ... Copyright 1986-2004 by cisco Systems, ... BOX in both H/W and S/W, compared to a C2924-XL Switch... ... FastEthernet0/1 failed front-end loopback test ... to make the port configuration "visible", you need to apply 2 commands ...
    (comp.dcom.sys.cisco)
  • RE: Network not accessible!!?
    ... So I would say you have some sort of port mirroring on the ... on the switch lately. ... the internet on either one of the two other PC's (named ...
    (microsoft.public.windowsxp.network_web)
  • Re: Cat 2924
    ... Copyright 1986-2004 by cisco Systems, ... BOX in both H/W and S/W, compared to a C2924-XL Switch... ... FastEthernet0/1 failed front-end loopback test ... to make the port configuration "visible", you need to apply 2 commands ...
    (comp.dcom.sys.cisco)
  • Re: OT: Questions about routers, switches, hubs, etc.
    ... when would I need a switch? ... All the devices connected to it can see all the packets. ... Devices only see the IP addresses that are hooked up to that port. ... Some where the port is directly exposed to the Internet, some behind the firewall (good for protecting computers). ...
    (rec.gambling.poker)