[netdrivers] receive only
Thu Aug 28 15:36:01 2003
We recently implemented Snort on several segments of our network. Ideally
we would like to have the Snort interface in a receive only mode on the
promiscuous interface. We can build a receive only cable or we can purchase
an ethernet tap (around $400). I'm not thrilled with either idea.
I'm wondering if it is possible to modify the code in the network drivers to
basically send the transmits to /dev/null rather than out on the wire.
The primary system we are concerned about is using the 3c59x module.