detecting network interfaces on IDS

[ravik77]

Hi

We have cisco IDS(netranger) running on sol 2.8. I want to know why the interface that is capturing packets does not show when I do ifconfig -a on the terminal session on the server. Is there a way to see the packets the IDS is capturing using snoop

Please let me know

Ravi

[marcabal]

The interfaces only show up in ifconfig -a if they have been "plumbed". Interfaces are generally only "plumbed" when an IP Address has been assigned to it.

The sniffing interface of the sensor does not have an IP address and so we decided not to "plumb" it.

So do not expect to see the sniffing interface in the ifconfig -a output on a 3.x sensor.

If you know the sniffing interface then you can still snoop on it even though it doesn't show up in ifconfig -a.

If you don't know the name of the interface then let me know the model number for your sensor and I'll let you know the interface name.

This is documented in one of the 3.1 docs, but I can't remember where.

[ravik77]

Marc..

Thanks for the reply. My IDS model is cisco IDS 4235. Can you please let me know the intrface I need to use in my snoop.

Thanks

Ravi

[marcabal]

Try snoop -d e1000g0

As a side note for other users.

The IDS-4250-TX sniffing interface is also e1000g0.

The IDS-4250-SX sniffing interface is e1000g2.

[brhamon]

In solpc-2.8, only plumbed interfaces appear in the output of the "ifconfig -a" command. You can snoop unplumbed interfaces with the "snoop -d (iface)" command. The trick is knowing the name of the interface.

One way is to guess, based on the platform. IDS-4220 and IDS-4230-FE sensors sniff on the "spwr0" interface. IDS-4210 sensors use "iprb0". I cannot say for sure what you'll see on IDS-4235 and IDS-4250; however, I think it is also "iprb0".

One way to find out without guessing is to examine the devices on the various system busses. Solpc-2.8 allows you to do this by issuing the following command (as root):

# find /devices -name '*spwr*' -o -name '*iprb*'

Here is example output (from an IDS-4210):

/devices/pci@0,0/pci8086,3000@c:iprb

/devices/pci@0,0/pci8086,3000@c:iprb0

/devices/pci@0,0/pci8086,3000@d:iprb1

This indicates that there are two Intel NICs in this system: iprb0 and iprb1. Try snooping on all the unplumbed interfaces (the ones that do _not_ appear in the "ifconfig -a" output).

# snoop -d iprb0