This idea is from the snort.org web site for invisible tap. Basically with a 24 port patch pannel, you can have 6 100M full duplex taps right from it. Each tap will use 4 ports, two ports for host connection and the other two for tap purpose. For example, I have port 1 and 4 for host and 2,3 for tap. I use 4 wires to connect the following 4 pin groups:
- pin 1 of port 1, pin 3 of port 2 and pin 1 of port 4
- pin 2 of port 1, pin 6 of port 2 and pin 2 of port 4
- pin 3 of port 1, pin 3 of port 3 and pin 3 of port 4
- pin 6 of port 1, pin 6 of port 3 and pin 6 of port 4
After that, you can get traffic from port 2 and port 3, one for sending and one for receiving traffic. Then you can use interface bonding to setup a virtual interface to capture the full duplex 100Mbps traffic. Cool!
Post new comment