[Snort-users] Can anyone recommend an ethernet tap?

Martin Olsson elof at ...6680...
Wed Oct 6 03:38:04 EDT 2004


I want to buy an ethernet tap where snort will listen.

A----Tap----B
      |
   Sniffer

Criteria:
* 100Mbps
* full duplex (not a hub then)
* the throughput between A and B should be almost the same as using a
  X-patch cable
* the sniffer port should see both directions of the traffic (if A and B
  generate more than 100Mbps together, start dropping packets), I do not
  want two sniffer ports where one see A->B and the other B->A, I just
  want one port that mirror B<->B

Maybe the sniffer-port could be 1Gbps, then packets wouldn't have to be
dropped, but I guess that the price of a gigabit tap is far more than a
100Mbps one...

I do not want to use a hub.
I do not want to use a switch with port mirroring support.

What product(s) should I look for? Not too expensive please. :-)

/Martin





More information about the Snort-users mailing list