On Fri, 28 Apr 2000, Lance Ecklesdafer wrote:
> You can sniff token-ring networks. The Sniffer product sends out a MAC frame
> that indicates that an adapter is running in promiscuous mode and this MAC
> frame can be picked up by token-ring managers that are monitoring for this
> type of activity. If the manager is configured to send a MAC frame to stop
At least one vendor used to ship a truly silent monitor card (it'd go
into promiscuous mode without alerting.) It was at one point preffered for
sniffer applications due to not participating in ring traffic at all (It
may have been a Madge card- I don't recall.)
I'm not sure if most cards implemented that portion of the protocol in ROM
or in drivers, but it's worth remembering not to trust a protocol
specification if it's possible that the spec can be ignored.
> If the adapter is configured in promiscuous mode the card will copy all
> traffic off the incoming frames as well as resend them to the next node.
> Sniffing a token-ring and understanding all of the MAC and LLC functions is
> quite a task without a good decoder like the Sniffer. There are a lot of
It's not that bad, IBM produced a *lot* of documentation, and everything
is standard. I've known quite a few people over the years who could do
non-assisted analysis for quite a few once-common issues.
> physical layout of the ring and the output of the AMP and SMP frames. I have
> used the Sniffer ALOT in my day and the troubleshooting of the token-ring
> network without it is really quite time consuming.
[OT]
If you're just looking for a bad node, it's pretty easy to break the ring
in half and check which side is still getting errors assuming the neighbor
isn't already screaming its head off. Even on >150 node rings, we never
spent too long splitting versus hauling a sniffer to the affected ring.
Back before the rj45 equipment got hot, most times standing near the LAM
or MAU would let you know who was jumping on and off the ring as the relay
switched on the port. click-click-click-click was a sure sign of a bad
adapter - ah the bad old days...
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
[EMAIL PROTECTED] which may have no basis whatsoever in fact."
PSB#9280
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
