jeff at ...950...
Wed Aug 25 10:42:11 EDT 2004
-----BEGIN PGP SIGNED MESSAGE-----
On Aug 25, 2004, at 8:44 AM, Paul Halliday wrote:
> I am currently using this tap:
> This tap sits between a cisco catalyst switch and a 2600 router. The
> link is full duplex and I am only capturing traffic on one of the
> ports on the tap. I have tried a cable in the other port and I dont
> get a link light. I have double checked the construction and
> everything seems to be as per the documentation. Has anyone else
> managed to get both streams with the use of this tap?
> Also, looking at:
> Would this be the better way to go? Is the item in the top left of
> this picture the same as the above tap? And the use of the switch is
> simply to combine the two streams?
> I have looked at purchasing a real tap from Securicore Inc that
> combines both streams into one on its own but they want 1300 CAD for
> one of these which is not really in our budget atm.
> What, if any, are my other options? -or- What have I missed on the
> Paul Halliday
> "Diplomacy is the art of saying "Nice doggie!" till you can find a
I'd do what Sandro Poppi suggested and try a crossover cable. I've
never tried to build my own passive Ethernet tap, so I can't offer much
on the topic. The diagram is wonderfully clear, however (nice job
The tap pictured in the 100Mb_tapping1 diagram is functionally the same
in that it splits the tx and rx into separate interfaces. It
represents a commercial tap. You're correct, the switch is there to
recombine the tx and rx pair.
Netoptics sells a tap that recombines the tx and rx pair called an
aggregator tap. I've had positive experiences with netopics products.
Take a look at their website:
Custom packets with little to no money down.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)
-----END PGP SIGNATURE-----
More information about the Snort-users