Re: port bonding and taps

From: Sam f. Stover (sstover_at_iwc.sytexinc.com)
Date: 10/02/03

  • Next message: Dpk: "Re: Multiple network segment monitor with Snort" 
    Date: Thu, 2 Oct 2003 11:31:37 -0400
To: Jeffrey.Stebelton@bisys.com

    On Thursday, October 2, 2003, at 10:57 AM, Jeffrey.Stebelton@bisys.com
    wrote:

    >
    > What we have done is to set a 10 Mb Ethernet hub up near the tap and
    > run
    > both tap ports into it. We then plug whatever sniffers you want into
    > the
    > hub and you will see both sides of the traffic.

    I think this works in a very small environment, but doesn't scale too
    well. Since the tap ports aren't participating in an Ethernet network
    the way a normal host does, there is a real opportunity for collisions.
      Especially when using a hub which is real dumb about things like this.

    It's all about your budget and needs, but for a little more money you
    can get a Cisco 2900 (or whatever vendor you prefer) which can mirror
    both Tx and Rx ports to a common port without the risk of collision.

    SfS

    ____
    S.f.Stover
    sstover@iwc.sytexinc.com

  • Next message: Dpk: "Re: Multiple network segment monitor with Snort"

    Relevant Pages

    • Re: port bonding and taps
      ... > near the tap and run both tap ports into it. ... Why use a tap at all if you are using a hub all the ... Intrusion Prevention and Traffic Shaping Technology to: ...
      (Focus-IDS)
    • Re: port bonding and taps
      ... Bammkkkk ... > What we have done is to set a 10 Mb Ethernet hub up near the tap and run ... > both tap ports into it. ... > BISYS Network Security Group ...
      (Focus-IDS)