[Snort-users] Home-made ethernet TAP
nbachmann at ...9372...
Tue Aug 19 05:12:11 EDT 2003
Frank Knobbe wrote:
>On Mon, 2003-08-18 at 23:42, Ryan B. Lynch wrote:
>>So here's the question: this took me ~20 minutes and $10 worth of parts
>>to gin up. Why the heck do ethernet TAPs cost $400 and up? I've STFW'd
>>and asked everyone I know who works with Ethernet, but no-one had ever
>>heard of a working homebrew TAP like this. Am I just using the wrong
>Must be. Some time ago I played with a cable which ended up in the Snort
>FAQ as the Read-only cable. There is a similar RO cable with a capacitor
>inline (to scramble the send signal) on the Internet. AUI connectors
>with the send line cut is another. I also made a cable that split into
>two pairs, one for each direction (like your cable). The drawback is
>that you would need to combine the traffic flow. Using two NICs like you
>have would work, using a buffered switch might be another approach. A
But if you use a swich, wouldn't the packets not be forwarded, since the
L2 forwarding table of the switch wouldn't have the sensor's MAC, and
the sensor wouldn't respond to an ARP request?
Some cheap switches may then just act as a repeater, but you probably
have to be careful with what you buy... right?
Nicholas Bachmann, SSCP
Davison Community Schools
More information about the Snort-users