[Snort-users] Cisco Catalyst - SNORT

Jeff Nathan jeff at ...950...
Fri Jun 27 16:24:05 EDT 2003


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



- --On Friday, June 27, 2003 7:34 -0400 Gary Flynn <flynngn at ...6811...> wrote:

>
>
>
> I'm not saying the switch works this way but if the packets are on a bus
> and configuring a span port just means telling the port to grab anything
> on the bus, it would seem there would be no performance hit.

Grabbing those frames and sending them out a different interface still 
requires I/O operations (interrupt request processing and the like). 
Hidden as it may be, there's always a price.

EOF.


> --
> Gary Flynn
> Security Engineer - Technical Services
> James Madison University
>
> Please R.U.N.S.A.F.E.
> http://www.jmu.edu/computing/runsafe

- -Jeff

- --
http://cerberus.sourcefire.com/~jeff       (gpg key available)
Great spirits have always encountered violent opposition from mediocre
minds.
- - Albert Einstein
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (Darwin)

iD8DBQE+/NHeEqr8+Gkj0/0RAiAVAJ0TqCbb/4ZaTCrA3P6UOzXO14aBnQCfei+a
Ez7l4RxzeObF2ipc/aQkllg=
=OOuU
-----END PGP SIGNATURE-----





More information about the Snort-users mailing list