Snort - [Snort-users] Looking for good hub

Author

[Snort-users] Looking for good hub

Bill Warren

2004-09-27, 5:47 pm

Can anybody suggest a good hub to sniff with? I have found out the
some of the "hubs" are just cheap switchs with very small arp cache. I
need a least 4 ports. I had been using the one from HP but, they
stopped making them. BTW the linksys hubs are switchs.

Thanks,
Bill

--

**********************************
Bill Warren
Optivel, Inc.
E-mail: bwarren@optivel.com
Voice: 317.275.2305
Fax: 317.275.2301
Web: http://www.optivel.com
**********************************

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Ty Bodell

2004-09-27, 5:47 pm

Bill--
Checkout the Netgear hubs, they're small enough to take on-site if you
need a tap on a specific segment and are reliable from my expereince.
I haven't been able to confirm your switch suspicious with these
models though.

4 Port
http://www.cdw.com/shop/products/de...aspx?EDC=138519

8 Port
http://www.cdw.com/shop/products/de...aspx?EDC=108249

Cheers,
Ty Bodell

On Mon, 27 Sep 2004 11:36:29 -0500, Bill Warren <bwarren@optivel.com> wrote:
> Can anybody suggest a good hub to sniff with? I have found out the
> some of the "hubs" are just cheap switchs with very small arp cache. I
> need a least 4 ports. I had been using the one from HP but, they
> stopped making them. BTW the linksys hubs are switchs.
>
> Thanks,
> Bill
>
> --
>
> **********************************
> Bill Warren
> Optivel, Inc.
> E-mail: bwarren@optivel.com
> Voice: 317.275.2305
> Fax: 317.275.2301
> Web: http://www.optivel.com
> **********************************
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
> Project Admins to receive an Apple iPod Mini FREE for your judgement on
> who ports your project to Linux PPC the best. Sponsored by IBM.
> Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
> ________________________________________
_______
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists...nfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf....ist=snort-users
>

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Bill Warren

2004-09-27, 5:47 pm

I was looking at that one but, they only problem is :

"The intelligent bridge automatically manages network traffic such that
100 Mbps traffic does not unnecessarily crowd the 10Mbps network segment
and 10Mbps traffic does not crowd the 100Mbps segment."

Thanks for looking. If I find on I will let you know.

Bill

Ty Bodell wrote:
[vbcol=seagreen]
>Bill--
>Checkout the Netgear hubs, they're small enough to take on-site if you
>need a tap on a specific segment and are reliable from my expereince.
>I haven't been able to confirm your switch suspicious with these
>models though.
>
>4 Port
>http://www.cdw.com/shop/products/de...aspx?EDC=138519
>
>8 Port
>http://www.cdw.com/shop/products/de...aspx?EDC=108249
>
>Cheers,
>Ty Bodell
>
>On Mon, 27 Sep 2004 11:36:29 -0500, Bill Warren <bwarren@optivel.com> wrote:
>
>

--

**********************************
Bill Warren
Optivel, Inc.
E-mail: bwarren@optivel.com
Voice: 317.275.2305
Fax: 317.275.2301
Web: http://www.optivel.com
**********************************

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Matt Kettler

2004-09-27, 5:47 pm

At 12:36 PM 9/27/2004, Bill Warren wrote:
>Can anybody suggest a good hub to sniff with? I have found out the some
>of the "hubs" are just cheap switchs with very small arp cache. I need a
>least 4 ports. I had been using the one from HP but, they stopped making
>them. BTW the linksys hubs are switchs.

*ALL* 10/100 dual-speed hubs must have some switching behavior, no matter
who makes it.

It's physically impossible to be dual speed and not switch. If you think
about passively repeating all traffic from a 100mbit segment into a 10-mbit
segment.. You'll be speed limited by the 10mbit segment, thus you'll be
relegated to being a 10mbit hub not a dual speed.

Some dual-speed hubs behave like a 10mbit hub and a 100mbit hub connected
by a two-port switch. Thus, if all ports are the same rate, it's a hub.
However, these are not common anymore. It's much more common nowdays for
"dual speed hubs" to be switches that don't support full-duplex and have small

If you want a pure passive hub, you're going to have to get a single-speed
one, and these are becoming more and more rare. I keep an eye on
liquidators like www.compgeeks.com. A while back they had a batch of old
3com 100mbit pure-passive single-speed hubs in and I got one for about $15.
I also got a 10mbit hub at the same time.

Although more costly, it's getting to the point where it's much easier to
find a low-end 10/100 managed switch that has SPAN capabilities, such as
the cisco catalyst 2950 12pt (about $500 ) .

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Bamm Visscher

2004-09-27, 5:47 pm

Bill,

You're not going to find a dual-speed hub that doesn't include a
switch between 10Mb and 100Mb traffic. I am not sure single speed
100Mb hubs still exist. I've used those hubs and they've worked fine
(both the 10/100 and 10 only versions). If you use the 10/100 hub,
just make sure any interface you plug into it negotiates to 100Mb.

Bammkkkk

On Mon, 27 Sep 2004 12:13:52 -0500, Bill Warren <bwarren@optivel.com> wrote:[vbcol=seagreen]
> I was looking at that one but, they only problem is :
>
> "The intelligent bridge automatically manages network traffic such that
> 100 Mbps traffic does not unnecessarily crowd the 10Mbps network segment
> and 10Mbps traffic does not crowd the 100Mbps segment."
>
> Thanks for looking. If I find on I will let you know.
>
> Bill
>
>
> Ty Bodell wrote:
>

--
sguil - The Analyst Console for NSM
http://sguil.sf.net

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Glenn Forbes Fleming Larratt

2004-09-27, 5:47 pm

We've had some success with NetGear products, with the caveat that the
10/100 versions seems to have internally a 100M hub, a 10M hub, and
a switch/bridge between them - so they won't do the right thing if
individual port speeds among "in", "out", and "tap" are not all the same.

-g

On Mon, 27 Sep 2004, Bill Warren wrote:

> Can anybody suggest a good hub to sniff with? I have found out the
> some of the "hubs" are just cheap switchs with very small arp cache. I
> need a least 4 ports. I had been using the one from HP but, they
> stopped making them. BTW the linksys hubs are switchs.

Glenn Forbes Fleming Larratt
Rice university Networking
glratt@rice.edu

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Hague, Jeff

2004-09-27, 5:47 pm

Also, if it says its capable of full duplex, it is a switch and not a
hub - hubs are half duplex by nature.

Jeff

-----Original Message-----
From: Bamm Visscher [mailto:bamm.visscher@gmail.com]=20
Sent: Monday, September 27, 2004 1:33 PM
To: Bill Warren
Cc: Ty Bodell; snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] Looking for good hub

Bill,=20

You're not going to find a dual-speed hub that doesn't include a
switch between 10Mb and 100Mb traffic. I am not sure single speed
100Mb hubs still exist. I've used those hubs and they've worked fine
(both the 10/100 and 10 only versions). If you use the 10/100 hub,
just make sure any interface you plug into it negotiates to 100Mb.

Bammkkkk

On Mon, 27 Sep 2004 12:13:52 -0500, Bill Warren <bwarren@optivel.com>
wrote:
> I was looking at that one but, they only problem is :
>=20
> "The intelligent bridge automatically manages network traffic such
that
> 100 Mbps traffic does not unnecessarily crowd the 10Mbps network
segment[vbcol=seagreen]
> and 10Mbps traffic does not crowd the 100Mbps segment."
>=20
> Thanks for looking. If I find on I will let you know.
>=20
> Bill
>=20
>=20
> Ty Bodell wrote:
>=20
you[vbcol=seagreen]

--=20
sguil - The Analyst Console for NSM
http://sguil.sf.net

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....t=3Dsnort-users

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Shackleford, David M.

2004-09-27, 5:47 pm

3COM OfficeConnect models are some good, cheap hubs:

http://www.3com.com/products/en_US/...thtype=purchase
&sku=3C16700A-US

HTH,
Dave

-----------------------------
Dave Shackleford, CISSP
Information Security Architect
Norfolk Southern Corp.
(404)962-5620
david.shackleford@nscorp.com

-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Bill Warren
Sent: Monday, September 27, 2004 12:36 PM
To: Snort-users@lists.sourceforge.net
Subject: [Snort-users] Looking for good hub

Can anybody suggest a good hub to sniff with? I have found out the
some of the "hubs" are just cheap switchs with very small arp cache. I need
a least 4 ports. I had been using the one from HP but, they stopped making
them. BTW the linksys hubs are switchs.

Thanks,
Bill

--

**********************************
Bill Warren
Optivel, Inc.
E-mail: bwarren@optivel.com
Voice: 317.275.2305
Fax: 317.275.2301
Web: http://www.optivel.com
**********************************

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project
Admins to receive an Apple iPod Mini FREE for your judgement on who ports
your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Bill Parker

2004-09-28, 3:00 am

----- Original Message -----
From: "Matt Kettler" <mkettler@evi-inc.com>
To: "Bill Warren" <bwarren@optivel.com>; < >
Sent: Monday, September 27, 2004 10:28 AM
Subject: Re: [Snort-users] Looking for good hub

> At 12:36 PM 9/27/2004, Bill Warren wrote:
>
> *ALL* 10/100 dual-speed hubs must have some switching behavior, no matter
> who makes it.
>
> It's physically impossible to be dual speed and not switch. If you think
> about passively repeating all traffic from a 100mbit segment into a
10-mbit
> segment.. You'll be speed limited by the 10mbit segment, thus you'll be
> relegated to being a 10mbit hub not a dual speed.
>
> Some dual-speed hubs behave like a 10mbit hub and a 100mbit hub connected
> by a two-port switch. Thus, if all ports are the same rate, it's a hub.
> However, these are not common anymore. It's much more common nowdays for
> "dual speed hubs" to be switches that don't support full-duplex and have
small
>
> If you want a pure passive hub, you're going to have to get a single-speed
> one, and these are becoming more and more rare. I keep an eye on
> liquidators like www.compgeeks.com. A while back they had a batch of old
> 3com 100mbit pure-passive single-speed hubs in and I got one for about
$15.
> I also got a 10mbit hub at the same time.
>
> Although more costly, it's getting to the point where it's much easier to
> find a low-end 10/100 managed switch that has SPAN capabilities, such as
> the cisco catalyst 2950 12pt (about $500 ) .

I just got my hands on a Entrasys (Cabletron) ELS100-TXM 24 port 10/100
switch with 802.1q and port mirror
capability for the whopping sum of $85.00 US (inc. fed ex ground shipping),
and it will sniff all the traffic ya
want, along with VLANS, CoS, QoS, Trunking, etc...

Bill

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Rich Adamson

2004-09-28, 3:00 am

> > >Can anybody suggest a good hub to sniff with? I have found out the some
> 10-mbit
> small
> $15.
>
> I just got my hands on a Entrasys (Cabletron) ELS100-TXM 24 port 10/100
> switch with 802.1q and port mirror
> capability for the whopping sum of $85.00 US (inc. fed ex ground shipping),
> and it will sniff all the traffic ya
> want, along with VLANS, CoS, QoS, Trunking, etc...

There's a reason why that specifc model is selling for that price. Its
got some serious issues with the software that Entrasys has never addressed
(and never will). I wouldn't install that switch in a production network
even if it was free. Home use, maybe.

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users