From owner-freebsd-stable Mon Aug 13 23:15:55 2001 Delivered-To: freebsd-stable@freebsd.org Received: from globalrelay.com (h216-18-71-77.gtcust.grouptelecom.net [216.18.71.77]) by hub.freebsd.org (Postfix) with ESMTP id D9AD137B40A for ; Mon, 13 Aug 2001 23:15:51 -0700 (PDT) (envelope-from lists@globalrelay.net) Received: from [24.76.149.87] (HELO cns) by globalrelay.com (CommuniGate Pro SMTP 3.4.7) with SMTP id 610108; Mon, 13 Aug 2001 23:15:50 -0700 Message-ID: <004301c12488$52f69b10$57954c18@cns> From: "Eric Parusel" To: "Chad R. Larson" , "FreeBSD Stable List" References: <20010813214553.A21348@freeway.dcfinc.com> Subject: Re: promiscuous but silent Date: Mon, 13 Aug 2001 23:13:08 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Try cutting the "Transmit" pair :) (not sure if it's wires 1&2 or 3&6) http://archives.neohapsis.com/archives/snort/2001-06/0268.html > I want to monitor the behavior of a firewall we're evaluating. I'd > like to run Ethereal or tcpdump and/or other such tools on both > sides of the firewall, to convince myself it's doing what it claims > to do (and don't even ask why I think it isn't). > > With one of those $25 four port hubs, I can get a FreeBSD notebook > in parallel with the firewall's input. But I want to be absolutely > sure the notebook stays quiet. That is, no ARP for its ownself when > bringing up the interface, nor responses to the network broadcast > address. Nada. > > But, tcpdump and friends need to be able to put the interface into > promiscuous mode and copy =all= the traffic it sees. > > Should it be obvious how to do that, or is something tricky > involved? > > -crl > -- > Chad R. Larson (CRL15) 602-953-1392 Brother, can you paradigm? > chad@dcfinc.com chad@larsons.org larson1@home.com > DCF, Inc. - 14623 North 49th Place, Scottsdale, Arizona 85254-2207 > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-stable" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message