[netdrivers] receive only

Prentice, Matthew mprentice@cff.org
Thu Aug 28 15:36:01 2003

We recently implemented Snort on several segments of our network.  Ideally
we would like to have the Snort interface in a receive only mode on the
promiscuous interface.  We can build a receive only cable or we can purchase
an ethernet tap (around $400).  I'm not thrilled with either idea.

I'm wondering if it is possible to modify the code in the network drivers to
basically send the transmits to /dev/null rather than out on the wire.

The primary system we are concerned about is using the 3c59x module.


Matthew Prentice