Ethernet Tap

I've created a tap to work with snort and I'm able to
see packets but not sure if I pinned it correctly. It
appears that I can only see packets sent from one end and not
sent from both ends. Did I wire it wrong?


568A Start 568A End
1 GW Tx+ ------------------------ 1 Gw Tx+
2 G Tx- ------------------------ 2 G Tx-
3 Ow Rx+ ----+------------------- 3 Ow Rx+
6 O Rx- ------+------------------6 O Rx-
| |
| | 568A Tap
| + --- 3 Ow Rx+
+------ 6 O Rx-

Thanks,
Chris

On Tue, 19 Aug 2003 18:09:29 -0400, Chris Fowler
<(E-Mail Removed)> wrote:
> I've created a tap to work with snort and I'm able to
> see packets but not sure if I pinned it correctly. It
> appears that I can only see packets sent from one end and not
> sent from both ends. Did I wire it wrong?
>
>
> 568A Start 568A End
> 1 GW Tx+ ------------------------ 1 Gw Tx+
> 2 G Tx- ------------------------ 2 G Tx-
> 3 Ow Rx+ ----+------------------- 3 Ow Rx+
> 6 O Rx- ------+------------------6 O Rx-
> | |
> | | 568A Tap
> | + --- 3 Ow Rx+
> +------ 6 O Rx-
>
Are the machines connected by a crossover cable? Maybe if you
used a hub you would see packets from both ends.

--
In memory of Hawley-Cooke Booksellers 1978-2003

Chris Fowler wrote:

> I've created a tap to work with snort and I'm able to
> see packets but not sure if I pinned it correctly. It
> appears that I can only see packets sent from one end and not
> sent from both ends. Did I wire it wrong?
>
>
> 568A Start 568A End
> 1 GW Tx+ ------------------------ 1 Gw Tx+
> 2 G Tx- ------------------------ 2 G Tx-
> 3 Ow Rx+ ----+------------------- 3 Ow Rx+
> 6 O Rx- ------+------------------6 O Rx-
> | |
> | | 568A Tap
> | + --- 3 Ow Rx+
> +------ 6 O Rx-

You've only got one side connected. You have to connect to both pairs.
However, the proper way, is to use a hub, not a switch, which will allow
you to monitor both sides of the connection. Be aware, that using a hub,
will force that computer to half duplex.

--

Fundamentalism is fundamentally wrong.

To reply to this message, replace everything to the left of "@" with
james.knott.