Ethereal-users: [Ethereal-users] Re: Looking for a new non-switched hub

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: TFEveritt@xxxxxxx
Date: Fri, 27 Jun 2003 04:31:50 -0400
To solve this problem I use a full-duplex ethernet wiretap device from www.criticaltap.com .

These are failsafe devices intended for invisible use to insert an Intrusion Detection System (e.g. snort, NFR, ISS, etc).

This presents 2 capture streams on separate interfaces.
I have a PC laptop with 2 LAN interfaces (one on motherboard and one PCCard/PCMCIA).
I use 2 iterations of tethereal, one collecting on eth0 and one collecting on eth1.
When collection is complete I use mergecap to create a single capture file.
Works a treat: RedHat 7.3, Ethereal 0.9.9


While I'm on my soapbox...

For the "ring buffer" type situation I just use tethereal running from cron for a fixed length of time. Again works perfectly.


Thanks to all the Ethereal team for a superb system. I've been using T&M kit for 20 years and Ethereal is right up there with the best.

Regards, Tim Everitt.
Aberdeen, Scotland.