RE: FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: External snort monitoring)

[Rich Adamson <radamson () routers com>]

> if you have a dual speed hub, and machines running both speeds (netcards
> with 10 and 100),

The issue is not simply a speed of 10 vs 100. The issue is "solely"
one of...
  "has the box manufacturer, whether it is called a hub or a switch,
   installed any software that would limit forwarding of all traffic
   out each port?"

The sales (and some support) people can't even tell you for sure in
most cases.

Over the last several years doing network consulting work, we've seen
hubs from various well known manufacturers that have included some
functions to limit the transmission of packets to selected ports when
the source and destination MAC addresses are known. The function does
have a small beneficial impact on efficiency/throughput, but the 
function is a problem for snort and sniffers.

In fact, I have two identitical (old) 3Com Super Stack hubs in the lab 
that do not have any network management function built into them. One 
functions more like a switch (eg, snort and sniffers do not see all 
traffic from all ports), while the other one acts like a dumb hub.
There are many other examples as well.

If you really want to get deep into tech stuff, open the cover and find
the ethernet chip set used by the manufacturer. Go to that chip set
manufacturers web site and you're likely to find explanations. For
example, one well known chip set supports up to four physical ports. 
When data is moved from one port to another on the same chip set, other 
external ports residing on other chip sets within the same box will not 
"see" that traffic. Some of the "newer" chip sets actually operate at layer 
three, looking deeper into each packet, impacting snort and sniffers
from a somewhat different perspective.



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users