[Snort-users] Can Snort report on 'late collisions'?

Matt Kettler mkettler at ...4108...
Mon Nov 24 13:26:04 EST 2003

At 03:37 PM 11/24/2003, Bryce Stenberg wrote:
>I've got a problem on our network where a router log shows it's ethernet
>connection is being reset often due to 'late collisions'. Searching google
>seemed to indicate a computer connected to it may have a faulty network card
>so I need to try to find the offending machine.

also keep in mind that often "late collisions" are usually due to a 
full-duplex-only adapter being attached to a passive HUB. They generally 
aren't the result of hardware failures, but it is possble.

Check the machines involved and see if they are all properly set for the 
right duplex.

Overly-long cables can also cause this problem.

>Is there anyway I could use snort (or winpcap) to detect/report on these
>late collisions? (even to only show if they are happening or not).  Or is it
>not possible as packets get discarded by the hardware?

hmm, not sure.. however I'd suspect if your router is complaining, they 
*are* happening.

More information about the Snort-users mailing list