Honeypots: RE: [inbox] undetectable NIC in promiscuous mode

["Teicher, Mark (Mark)" <teicher () avaya com>]

Network Taps by
http://www.hcssystems.com/products/finisar/tapoptions.html are very
useful and VoIP readiness assessment monitoring products such as
http://www.hcssystems.com/products/ringsphere/ram.html

/hope this helps

.mht

-----Original Message-----
From: Chris Brenton [mailto:cbrenton () chrisbrenton org] 
Sent: Friday, March 05, 2004 06:38 PM
To: Bement, Daniel
Cc: honeypots () securityfocus com
Subject: RE: [inbox] undetectable NIC in promiscuous mode

On Fri, 2004-03-05 at 16:25, Bement, Daniel wrote:
> There have been situations (depending on the hardware) I have seen
where if one of the wires in the TX pair is cut or (not making good
connection) it will still maintain link with the switch while not
allowing any data to pass through to the switch..

Sounds like you made an accidental choke circuit. ;-)

I've actually built boxes to do exactly what you describe. Basically you
tune the TX circuit to shunt 10 MHz to ground for 10 Mb, and 100 MHz for
100 Mb. This permits DC to pass, allowing link to be established, but
chokes out any Ethernet transmissions.

C