No subject

Thu Nov 23 16:36:19 EST 2017

Ethernet hubs (or switches) checks the "link status" of the cable, which is=
 done by periodically detecting if any signal has ever been received. If yo=
u simply disconnect the transmit pair of the cable, the hub will not detect=
 anything from the cable and therefore, report the cable as "not connected".

The method here is tried to introduce large amount of errors in the transmi=
ssion path, so that signal can still be detected, but almost no packet can =
pass the CRC error check.

John Hicks

-----Original Message-----
From: Matt Kettler [mailto:mkettler at ...4108...]
Sent: Monday, February 03, 2003 8:58 PM
To: David Culp
Cc: snort-users at
Subject: Re: [Snort-users] eth0 without ip

Ahh, given that it's a mirror port, the switch probably forwards packets=20
always and ignores the input link signal.

A lot of hardware won't do that. It will refuse to send unless there's a=20
link-beat coming back in.

At 08:36 PM 2/3/2003 -0500, David Culp wrote:
>Thanks for the information ...
>The eth1 (Headless) interface is using the "no transmit" cable
>to "mirror" the switch port that our public router is connected to.
>Other than hardware errors, it seems to be catching all traffic (sent/recv)
>that is passing through the router.
>Public Switch:
>         Port m    <-> ISP Router
>         Port  n    <-> Snort eth1 interface (no transmit)
>where the switch is set to mirror all traffic (<-> m) to n.

This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld =3D Something 2 See!
Snort-users mailing list
Snort-users at
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list