port mappings for IDS-4250-XL:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/hwguide/hwchap3.htm#770216
In step 4 you will see the following statements:
int0 is the sniffing port.
int1 is the command and control port.
int2 is the optional SX (fiber NIC) sniffing port.
int2 and int3 are the optional XL card sniffing ports.
int2 through int5 are the optional 4FE card sniffing ports.
In addition you can refer to:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/hwguide/hwchap3.htm#770196
Which states that on the 4250-XL the int0 port is the TCP Reset interface instead of a sniffing interface.
What is sometimes confusing, however, is that the driver for the XL card does not necessarily list the 2 ports of the XL card as int2, and int3 in all cases.
Instead the 2 ports are sometimes listed as falcon1 and falcon2. Falcon is the name of the driver for the XL card.
Within the IDS software int2 is mapped to falcon1, and int3 is mapped to falcon2.
You can see this is the case in the output of "show interfaces". Here is a small piece of the output:
Sensing int2 is down
Hardware is falcon1, XL
Another thing that has confused some users is that Neither int2 nor int3 will be seen when executing "ifconfig -a" while in the service account. This is because the XL card can not be configured from Linux like standard interfaces, and is therefore not seen when executing "ifconfig -a" and not be monitored with tcpdump.
