>From google... http://www.silicondefense.com/techsupport/ro-ethernet.htm
http://www.mcabee.org/lists/snort-users/Jun-01/msg00504.html http://www.robertgraham.com/pubs/sniffing-faq.html - 3.6 How can I create a receive-only Ethernet adapter? You use 2 cards, one in 'read-only' promiscous mode sniffing the wire, the other connected to the management network (& severly restricted) to communicate with the sensor. Regards JT --- Rory <[EMAIL PROTECTED]> wrote: > I'm assuming here by the information you've given so if > i'm wrong please > correct me. You want to make a cable that allows the > traffic to go in one > direction. the idea being that your snort box does not > send information > just receives it. I don't think you can do this with a > special cable as > ethernet need to be able to send acks back to let the > sending side know > that it received that data. So you will need to do this > at OS level not > with a special cable. If you were to do what you were > suggesting the > sending box would send only the number of packets in the > TCP window and > that would be it (it mayt resend them but in the end it > will just be a > small set of information ). you will need to do this with > chain rules. > > If my assumptions were totally wrong sorry. > > cheers, > Rory > > On Tue, 11 Feb 2003, Naman Latif wrote: > > > Hi, > > Can anyone tell me how to make a Read-Only Ethernet > Cable to be used > > with Snort\Sniffer > > > > IS this correct > > > > LAN Snort\Switch > > 1 1 > > 2 2 > > 3----------3 > > 4 > > 5 > > 6----------6 > > 7 > > 8 > > > > Then on both sides, connect 1&2 to eachother ? > > > > \\ Naman > > > __________________________________________________ Do you Yahoo!? Yahoo! Shopping - Send Flowers for Valentine's Day http://shopping.yahoo.com
