[Snort-users] strange promiscous mode behavior
Jason.Haar at ...294...
Sun Feb 3 16:32:02 EST 2002
On Thu, Jan 31, 2002 at 11:47:07PM -0800, Chris Grout wrote:
> Check what speed all external interfaces have negotiated too. Keep in
> mind that many 10/100 hubs actually will switch traffic between the 10
> mbit devices and the ones at 100. I'm not a netgear guru, but I know
> this is the case with the "smarter" 10/100 hubs. Obviously to rememdy
> this, just hard code everything to one speed.
Absolutely. Also, don't trust what the little lights tell you.
We have a 3COM 10/100 hub here that was claiming out Cisco was running
100M-FD when it had "speed 10; half-duplex" set.
Hard code, hard code, hard code
... and when you have an Ethernet card that can't be hard coded, GET ONE
THAT CAN!!! :-)
Information Security Manager
Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
More information about the Snort-users