Brian Kolaci writes: > > How is 'snoop' insufficient? > > > The question came up as to whether snoop sees all NIC traffic or just > wire traffic. > He noted that some NIC's still process the packet but just pass it back > to the > driver rather than the wire... He wants to prove that it doesn't even > hit the NIC. > Will snoop detect all traffic to/from the card ?
Snoop uses DLPI loopback to read the packets. How it works depends on the driver implementation (somewhat), but basically you get a copy of every packet that the upper level (such as IP) sends and a copy of every packet received on the wire. It's not necessarily enforced that every packet you see via DLPI loopback is in fact transmitted -- some might not be -- but the ones that you don't see aren't sent. -- James Carlson, KISS Network <[EMAIL PROTECTED]> Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 _______________________________________________ zones-discuss mailing list [email protected]
