[Snort-users] OT-Read Only Network cables

Frank Knobbe fknobbe at ...652...
Tue Jun 24 12:35:22 EDT 2003

On Tue, 2003-06-24 at 13:43, Mike Feetham wrote:
> I have seen a reference or two in this list about read-only network
> cables.  Does anyone have a website or other documentation on how to
> make them?  Is it just a matter of snipping the send pair on a cat5?
> I'm putting together some IDS boxes for a couple of companies that are
> too cheap/can't afford taps.

If you are referring to the cable pin-out in the Snort FAQ:
I never created instructions (although I wanted to make a movie on how
to crimp one at one time... just never found the time), except for some 
lines in email and what pin goes where (basically describing the pin-out
in words). But I have a couple images that offer a clue:
  http://www.snortsam.net/1.jpg (Sniffer side)
  http://www.snortsam.net/2.jpg (LAN side)
  http://www.snortsam.net/3.jpg (LAN side) 

There is also a diagram somewhere for a cable with a capacitor. My cable
doesn't have that, instead it loops the output back into input which
confuses the hell out of switches. Works great on a hub though. Anyhow,
from the picture you can guess how to make it. Getting to leads into one
hole requires a bit of patience but it's not too bad. Just strip the
wire as you can see in the image.

(That said, it only works on solid wire, not stranded :)

Hope this helps,

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030624/27a22b62/attachment.sig>

More information about the Snort-users mailing list