[Snort-users] Can Snort report on 'late collisions'?
mkettler at ...4108...
Mon Nov 24 13:26:04 EST 2003
At 03:37 PM 11/24/2003, Bryce Stenberg wrote:
>I've got a problem on our network where a router log shows it's ethernet
>connection is being reset often due to 'late collisions'. Searching google
>seemed to indicate a computer connected to it may have a faulty network card
>so I need to try to find the offending machine.
also keep in mind that often "late collisions" are usually due to a
full-duplex-only adapter being attached to a passive HUB. They generally
aren't the result of hardware failures, but it is possble.
Check the machines involved and see if they are all properly set for the
Overly-long cables can also cause this problem.
>Is there anyway I could use snort (or winpcap) to detect/report on these
>late collisions? (even to only show if they are happening or not). Or is it
>not possible as packets get discarded by the hardware?
hmm, not sure.. however I'd suspect if your router is complaining, they
More information about the Snort-users