[wellylug] Dummy ethernet crossover?

[Ewen McNeill]

In message <20040928050720.25651 at mail.pbp.net>, "Edmund A. Hintz" writes:
>    I've got a bit of an oddball problem here... I need to fool an
>ethernet interface into thinking it's up (it's a long story, just trust
>me that I need to do this). 

Putting 2 and 2 together and getting 5, I think I know why you want to
do this.  Even if it's not the "usual" reason people want to do this.

Your problem is also a common problem with various DIY "passive ethernet
taps" or "receive only network connection" or similar (used for traffic
monitoring, such as with snort).  I've read various papers about some
people's experiements, but haven't been able to Google up the best one in
the last few minutes.

As I remember it their conclusion was that for reliable operation with a
range of hardware they needed another switch to supply the carrier for
their receive-only line, because otherwise they were in a catch-22
situation where neither end would supply carrier because the other end
wasn't.  (This being a side effect of the 10/100/1000 auto negotiation
issues amongst other things.)

These two, which Google did turn up, may be of some help:

http://www.snort.org/docs/tap/
http://www.dggomez.arrakis.es/secinf/roc/roc.pdf

although a quick skim of them suggests that they too are using another
switch port to supply the carrier.

It may be easier just to carry a switch around with you.  There are some
tiny (eg, size of a pack of playing cards) 5-port Ethernet switches
around which can be powered off a USB port for fairly reasonable prices
these days (by which I mean "less than an hour of consulting time"
prices).

Ewen