[netdrivers] receive only

[Donald Becker]

On Thu, 28 Aug 2003, Prentice, Matthew wrote:

> We recently implemented Snort on several segments of our network.  Ideally
> we would like to have the Snort interface in a receive only mode on the
> promiscuous interface.  We can build a receive only cable or we can purchase
> an ethernet tap (around $400).  I'm not thrilled with either idea.
>
> I'm wondering if it is possible to modify the code in the network drivers to
> basically send the transmits to /dev/null rather than out on the wire.

It's straight-forward to do this -- we've implemented for a client that
had a similar requirement.  But this is a narrow requirement, so you
won't see this in the standard driver code.

-- 
Donald Becker				becker@scyld.com
Scyld Computing Corporation		http://www.scyld.com
914 Bay Ridge Road, Suite 220		Scyld Beowulf cluster system
Annapolis MD 21403			410-990-9993