Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cannot bring up promisc interface

I have a IDS-4210 running 3.1-3-S31. nr.packetd is running along with other nr daemons. For some reason, I'm unable to see any traffic when I snoop on /dev/iprb0. When I do a "ifconfig -a" I don't see iprb0 either.

I changed the sensing interface in packetd.conf from "auto" to "/dev/iprb0" and restarted nr - doesn't work again.

2 REPLIES
Silver

Re: Cannot bring up promisc interface

I feel you should probably try a snoop on -d iprb1 port 45000. UDP 45000 is used by IDS devices to communicate with each other.

Cisco Employee

Re: Cannot bring up promisc interface

iprb0 will not show up in the ifconfig -a output because it does not have an IP address assigned.

If you are not able to see anything with "snoop -d iprb0" (be sure to run this as root) then it could be an interface problem or something as simple as a cord not being plugged in.

Check your network cables and ensure they are plugged into the correct ports.

Verify that you have link lights on the sensor and the device to which it is connected.

If it is a switch then you will also need to use Span (or VACL Capture if using a Cat6500) to send copies of packets to the sensor.

Another thing to try is from within IDM check the sensor statistics:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids8/13876_01.htm#xtocid60

Reload the window and see if the packet counts are increasing.

105
Views
0
Helpful
2
Replies
CreatePlease login to create content