[mrtg] Re: Any ethernet switch which always floods?

[SHOLAAS Margaret G]

If the tap folded the traffic in each full-duplex direction (two wires) onto
one wire, cascading would work. Unfortunately each tap has two outputs (as
well as two inputs), representing the traffic in each direction, so what
comes out of the tap (two wires) is exactly what went in (two wires) and it
can't be used to merge different data streams.

The problem with trying to use a hub to merge the datastreams from the taps
is that tap output is just output, no input and no intelligence, therefore
no mechanism for detecting and dealing with the collisions that would
inevitably happen if other tap outputs were also plugged into the hub.

A switch with a port set to full duplex, however, expects the device
connected to that port to monopolize the wire (that is, it expects the
device not to deal with collisions), and will buffer the stuff coming it so
that all the packets from all the tap outputs are all folded together.

A good idea Josh Parker had was mirroring (SPANing) to ONE switch port, then
putting a hub on that port to make the data available to multiple devices.
This would minimize the amount of SPANing the box had to do, if I couldn't
figure out how to force flooding.

-----Original Message-----
From: Daniel J McDonald always floods?

Let's say you want to put 4 devices on this monitoring device.  Taps are a
couple of hundred bucks.  A switch is a thousand or so.  Would four taps in
serial be cheaper than a switch?

I personally don't see anything wrong with using a hub off the tapped port,
since you are only going to be able pull one direction from a tap, and the
Sniffer/IDS/RMON Probe/Content filter/Website approver shouldn't be making
any noise out of that interface anyway....

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi