[Snort-users] Is it really a HUB?

Matt Kettler mkettler at ...4108...
Fri Nov 28 11:05:05 EST 2003

At 11:31 PM 11/27/2003, kenw at ...10492... wrote:
> >The problem is that the actual implementation may have more switching
> >behavior than advertized.. all they've guaranteed is that the 10/100
> >segments are bridged.. but that doesn't mean that the 100mbit ports can't
> >be fully switched with respect to each other too.
>According to Cisco's literature, these hubs provide "100-Mbps peak
>aggregate throughput".  That implies no switching on the 100Mbps side.

True, although they are free to give you more than advertised. Implications 
are not specifications.

I've encountered at least one dual-speed hub, a netgear model, that behaved 
more like a switch than a hub between 100mbit ports. (I tried to hook a 
100mbit/sec sniffer in between two 100mbit devices and saw nothing). The 
big difference is that it only supported half duplex, unlike most switches.

Basically all I was stating was that it *might* behave like a switch or a 
hub.. Despite the Cisco literature, I still see nothing in there that 
solidly ensures hub-like behaviors between 100mbit ports. Thus, I still say 
that either behavior is possible.

It could act like a hub, or a switch, and neither behavior is guaranteed by 
the spec.

More information about the Snort-users mailing list