Date: Tue, 8 Oct 2002 17:30:00 -0400 From: Chuck Swiger <cswiger@mac.com> To: freebsd-security@FreeBSD.ORG Subject: Re: Sniffer nic Message-ID: <19A537BF-DB05-11D6-9582-000A27D85A7E@mac.com> In-Reply-To: <20021008205801.M19596@babayaga.neotext.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tuesday, October 8, 2002, at 04:58 PM, Duncan Patton a Campbell is Dhu
wrote:
> Hmm. I don't know anything about the cards mentioned here
> or the application you are putting the sniffer to, but you
> should consider whether you need to look outside the usual sense
> window for the card -- iff you are looking for network layer
> virii or other out-band transmissions.
Most people don't pay attention to low-level stuff like ARP/RARP, ICMP
redirects, source routing, and so forth-- you're right.
However, when packet sniffing, you generally run the network interface in
promiscuous mode so that it pays attention to all of the traffic going by
on the wire. Someone sending raw 802.3 frames (rather than frames
encapsulating IP packets) is still sending packets of data that a sniffer
will see.
On Tuesday, October 8, 2002, at 05:21 PM, twig les wrote:
> What kind of performance increase will I see with a
> 64-bit 100BT nic vs the same card running in a 32-bit
> slot? I'm tryig to figure out if it's worth the extra
> $30 before I tell my boss to get it (well...ask him).
A normal 32-bit PCI bus gives you 133 Mb/s of bandwidth, which is enough
to saturate a 10/100 card. Of course, if you're doing other things on
the machine at the same time, it's nice to put your NIC and other devices
on different PCI busses, so there will be some advantage to using the
64-bit PCI slot anyway.
A 64-bit slot would be better suited for a 10/100/1000 gigabit ethernet
card, or for something like a fast SCSI-3 (Ultra-160) card....
-Chuck
Chuck Swiger | chuck@codefab.com | All your packets are belong to
us.
-------------+-------------------+-----------------------------------
"The human race's favorite method for being in control of the facts
is to ignore them." -Celia Green
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19A537BF-DB05-11D6-9582-000A27D85A7E>