Thu Nov 23 16:36:19 EST 2017
Ethernet hubs (or switches) checks the "link status" of the cable, which is=
done by periodically detecting if any signal has ever been received. If yo=
u simply disconnect the transmit pair of the cable, the hub will not detect=
anything from the cable and therefore, report the cable as "not connected".
The method here is tried to introduce large amount of errors in the transmi=
ssion path, so that signal can still be detected, but almost no packet can =
pass the CRC error check.
From: Matt Kettler [mailto:mkettler at ...4108...]
Sent: Monday, February 03, 2003 8:58 PM
To: David Culp
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] eth0 without ip
Ahh, given that it's a mirror port, the switch probably forwards packets=20
always and ignores the input link signal.
A lot of hardware won't do that. It will refuse to send unless there's a=20
link-beat coming back in.
At 08:36 PM 2/3/2003 -0500, David Culp wrote:
>Thanks for the information ...
>The eth1 (Headless) interface is using the "no transmit" cable
>to "mirror" the switch port that our public router is connected to.
>Other than hardware errors, it seems to be catching all traffic (sent/recv)
>that is passing through the router.
> Port m <-> ISP Router
> Port n <-> Snort eth1 interface (no transmit)
>where the switch is set to mirror all traffic (<-> m) to n.
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld =3D Something 2 See!
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users