Brian Kolaci writes:
> > How is 'snoop' insufficient?
> The question came up as to whether snoop sees all NIC traffic or just
> wire traffic.
> He noted that some NIC's still process the packet but just pass it back
> to the
> driver rather than the wire... He wants to prove that it doesn't even
> hit the NIC.
> Will snoop detect all traffic to/from the card ?
Snoop uses DLPI loopback to read the packets. How it works depends on
the driver implementation (somewhat), but basically you get a copy of
every packet that the upper level (such as IP) sends and a copy of
every packet received on the wire.
It's not necessarily enforced that every packet you see via DLPI
loopback is in fact transmitted -- some might not be -- but the ones
that you don't see aren't sent.
James Carlson, KISS Network <[EMAIL PROTECTED]>
Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677
zones-discuss mailing list