[Snort-users] strange promiscous mode behavior

Jason Haar Jason.Haar at ...294...
Sun Feb 3 16:32:02 EST 2002


On Thu, Jan 31, 2002 at 11:47:07PM -0800, Chris Grout wrote:
> Check what speed all external interfaces have negotiated too.  Keep in
> mind that many 10/100 hubs actually will switch traffic between the 10
> mbit devices and the ones at 100.  I'm not a netgear guru, but I know
> this is the case with the "smarter" 10/100 hubs.  Obviously to rememdy
> this, just hard code everything to one speed.

Absolutely. Also, don't trust what the little lights tell you.

We have a 3COM 10/100 hub here that was claiming out Cisco was running
100M-FD when it had "speed 10; half-duplex" set.

Bollocks.

Hard code, hard code, hard code

... and when you have an Ethernet card that can't be hard coded, GET ONE
THAT CAN!!! :-)

-- 
Cheers

Jason Haar

Information Security Manager
Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417




More information about the Snort-users mailing list