Jay R. Ashworth wrote:
And, note carefully: some "dual-speed hubs" are actually a 10BT hub and
a 100BT hub *with a switch between them*. I forget which brand I
caught this on, but it bit me a couple of years back.
3COM Dual-Speed 10/100 hubs were this way. Got bit by that too back in
the day
All,
On the subject of turning off mac learning on a switch, I've just
discovered this - an unusual way of using RSPAN to force the MAC
learning off on Cisco switches:
http://blog.internetworkexpert.com/2008/02/05/turning-switch-into-hub/
# Turn MAC learning on ports Fa0/1 - 3
vtp mode tran
On Wed, 30 Jul 2008, Jon Kibler wrote:
However, there is a problem with your specification: No hub (that I am
aware of) can do 1Gbps. All hubs are 10/100 AFAIK.
GigE is PtP at the physical-layer by the IEEE 802.3ad specification.
It's just not possible to have a dumb, GigE hub. You have to ha
On Fri, 1 Aug 2008, Paul Jakma wrote:
GigE is PtP at the physical-layer by the IEEE 802.3ad specification. It's
Gah, I meant 802.3ab, of course.
just not possible to have a dumb, GigE hub. You have to have a switch that
can be told to L2-forward everything to one or more ports (e.g. through
Hey,
On Thu, 31 Jul 2008 16:00:36 +0100
Leon Ward <[EMAIL PROTECTED]> wrote:
>
> On 31 Jul 2008, at 14:16, Juuso Lehtinen wrote:
>
> > Second that.
> >
> > Using hub to tap into a single link is also risky. I used to monitor
> > single FE link with 100M hub. After link had moderate utilizatio
I have had the same problem and solved it with a rare (even then)
100BT Only hub. I still have at least one stashed away.
For years though, I have been using bonding on Linux to combine multiple
tap streams. We also use hardware aggregators for the higher volume
applications.
Jon
On Thu, Jul 31,
On Jul 31, 2008, at 12:31 PM, Jay R. Ashworth wrote:
On Wed, Jul 30, 2008 at 02:47:11PM -0400, Jon Kibler wrote:
Hubs are still available that are REAL hubs. I got 4 netgears about a
year ago and they are still available.
However, there is a problem with your specification: No hub (that I
a
On Wed, Jul 30, 2008 at 02:47:11PM -0400, Jon Kibler wrote:
> Hubs are still available that are REAL hubs. I got 4 netgears about a
> year ago and they are still available.
>
> However, there is a problem with your specification: No hub (that I am
> aware of) can do 1Gbps. All hubs are 10/100 AFAI
On 31 Jul 2008, at 14:16, Juuso Lehtinen wrote:
Second that.
Using hub to tap into a single link is also risky. I used to monitor
single FE link with 100M hub. After link had moderate utilization
>20%, collision led was lit all the time.
I've had good experience with VSS Monitoring Ether
Second that.
Using hub to tap into a single link is also risky. I used to monitor single
FE link with 100M hub. After link had moderate utilization >20%, collision
led was lit all the time.
I've had good experience with VSS Monitoring Ethernet Aggregator taps. Also
Catalyst 2960 SPAN seems to wor
assuming the analysis
software you have can read the dot1q tags, but means you do not need to
burn two ports per monitor.
-Original Message-
From: James Pleger [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 29, 2008 19:26
To: [EMAIL PROTECTED]
Subject: Re: Hardware capture platforms
There
Lynda wrote:
Warren Kumari wrote:
What I am looking for is: Small enough to live in my notebook bag
(e.g.: 4 port with a wall wart.) Cheap Simple 10/100/1000Mbps
I don't believe that such a thing ever existed. Hubs that did 10/100,
certainly, but I've never ever seen a hub that did gig speed
Warren Kumari wrote:
On Jul 29, 2008, at 10:43 PM, Darryl Dunkin wrote:
Hubs sure are fun...
This might be a stupid question, but where can one get small hubs
these days? All of the common commodity (eg: 4 port Netgear) "hubs"
these days are actually switches.
What I am looking for is:
On Jul 31, 2008, at 5:44 AM, [EMAIL PROTECTED] wrote:
Check out Endace cards, that will let you do line rate gig e or
better and has native libpcap interface.
I believe Endace also have a productized box containing their capture
cards (NinjaProbe); it can be used to capture packets, and ca
Jon Kibler wrote:
Hubs are still available that are REAL hubs. I got 4 netgears about a
year ago and they are still available.
However, there is a problem with your specification: No hub (that I am
aware of) can do 1Gbps. All hubs are 10/100 AFAIK.
Grand Junction made a gigabit Ethernet repea
On Tue, 29 Jul 2008, John A. Kilpatrick wrote:
We've deployed a bunch taps in our network and now we need a platform on
which to capture the data. Our bandwidth is currently pretty low but I've
got 8 links to tap, which means I need 16 ports. Has anyone done any
research on doing accurate pa
| One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
www.otaotr.com | Phone: 914-460-4039
aim: matthewbhuff | Fax: 914-460-4139
-Original Message-
From: Lynda [mailto:[EMAIL PROTECTED]
Sent: Wednesday, July 30, 2008 2:52 PM
To: Nanog
Subject: Re: Hardware capture platf
Warren Kumari wrote:
On Jul 29, 2008, at 10:43 PM, Darryl Dunkin wrote:
Hubs sure are fun...
This might be a stupid question, but where can one get small hubs these
days? All of the common commodity (eg: 4 port Netgear) "hubs" these
days are actually switches.
True enough. For those
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Warren Kumari wrote:
>
> On Jul 29, 2008, at 10:43 PM, Darryl Dunkin wrote:
>
>> Hubs sure are fun...
>>
>
> This might be a stupid question, but where can one get small hubs these
> days? All of the common commodity (eg: 4 port Netgear) "hubs" the
to
burn two ports per monitor.
-Original Message-
From: James Pleger [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 29, 2008 19:26
To: [EMAIL PROTECTED]
Subject: Re: Hardware capture platforms
There are several things that you can do with open source solutions,
however looking at the da
On 30 Jul 2008, at 03:26, James Pleger wrote:
Something you might want to look into is traffic aggregation with a
switch or hub. You can buy an Allied Telesyn switch and basically turn
it into a hub by disabling switchport learning. Just an idea.
Never try to aggregate multiple TAPs with a hu
trick" <[EMAIL PROTECTED]>
Subject: Hardware capture platforms
To: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]>
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
We've deployed a bunch taps in our network and now we need a platform
on
which to capture the data.
need to
burn two ports per monitor.
-Original Message-
From: James Pleger [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 29, 2008 19:26
To: [EMAIL PROTECTED]
Subject: Re: Hardware capture platforms
There are several things that you can do with open source solutions,
however looking at the
There are several things that you can do with open source solutions,
however looking at the data may be a bit more difficult than something
like Network Generals or Solera Networks capture appliances. It is
still doable and is definitely much much cheaper...
Something you might want to look into i
Richard's blog @ http://taosecurity.blogspot.com/search?q=taps and
especially his books (Tao of Network Security Monitoring and Extrusion
Detection) are the best sources I have ever found, concerning [not only]
taps and[/but] so much more on the subject - proper usage and best
methodologies and pra
On Wed, Jul 30, 2008 at 12:35 AM, Jared Mauch <[EMAIL PROTECTED]> wrote:
> Check out packet forensics depending on what your ultimate requirements are.
>
I would also add a 'see packet forensics'...
> On Jul 29, 2008, at 7:10 PM, "John A. Kilpatrick" <[EMAIL PROTECTED]>
> wrote:
>
>>
>> We've dep
solera makes some nice boxes also
On Tue, Jul 29, 2008 at 7:35 PM, Jared Mauch <[EMAIL PROTECTED]> wrote:
> Check out packet forensics depending on what your ultimate requirements
> are.
>
> Jared Mauch
>
>
> On Jul 29, 2008, at 7:10 PM, "John A. Kilpatrick" <[EMAIL PROTECTED]>
> wrote:
>
>
>>
Check out packet forensics depending on what your ultimate
requirements are.
Jared Mauch
On Jul 29, 2008, at 7:10 PM, "John A. Kilpatrick" <[EMAIL PROTECTED]>
wrote:
We've deployed a bunch taps in our network and now we need a
platform on which to capture the data. Our bandwidth is cu
We've deployed a bunch taps in our network and now we need a platform on
which to capture the data. Our bandwidth is currently pretty low but
I've got 8 links to tap, which means I need 16 ports. Has anyone done any
research on doing accurate packet capture with commodity hardware?
--
29 matches
Mail list logo
