Brian Kolaci writes:
> > How is 'snoop' insufficient?
> >
> The question came up as to whether snoop sees all NIC traffic or just 
> wire traffic.
> He noted that some NIC's still process the packet but just pass it back 
> to the
> driver rather than the wire...  He wants to prove that it doesn't even 
> hit the NIC.
> Will snoop detect all traffic to/from the card ?

Snoop uses DLPI loopback to read the packets.  How it works depends on
the driver implementation (somewhat), but basically you get a copy of
every packet that the upper level (such as IP) sends and a copy of
every packet received on the wire.

It's not necessarily enforced that every packet you see via DLPI
loopback is in fact transmitted -- some might not be -- but the ones
that you don't see aren't sent.

James Carlson, KISS Network                    <[EMAIL PROTECTED]>
Sun Microsystems / 1 Network Drive         71.232W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.496N   Fax +1 781 442 1677
zones-discuss mailing list

Reply via email to