IDS 4235 Configuration

[community]

I have recently installed a 4235 sensor. I am not getting any activity on the siffer port. I have moved the cables around but still have no luck. How do I edit the packetd.conf file to make sure the settings are correct?

[rwassom]

What version of the software are you running?

You should not be modifying the packetd.conf file manually.

C&C is Port 2 on the back of the box. Sniffing is Port 1.

[community]

3.1-3-S37

That is how I have the cables plugged in. There is only a link light on port 2 with activity, port 1 has no lights at all. When the sensor boots I see some error concerning the ethernet but it passes to fast to read.

[5mlattimore]

Initially I saw the same issue. It seemed to have a problem with the port speed setting. But after I got the device configured and talking to the IDS MC, I plugged a cable into port 2 again and it started working - all of a sudden.

We used to call this RFM>> Real Friggin' Magic :)

try connecting the cable while the 4235 is on, and then disconnecting it to see if you get the message "adapter just lost copper link"

Then plug it in again and see if you get "adapter copper link is up"

At least that will tell ya if it sees the link.

Good luck,

[bbenton]

FYI, I had similiar problems with a new 4235 and 4210 just this week. Had to add the sensing interface in packetd.conf, replacing the "auto" that was there, on BOTH! I also had to do this on a 4210 a year ago. The cables were both plugged in when all of them were first cranked up, and both had link lights. dmesg always found both interfaces, but netstat -i never showed the sensing interface active until I edited packetd.conf and rebooted. Restarting NR didn't do it, had to do a full reboot. All of these are upgraded through the mutiple service packs and sig's until they were running S39 before we did anything about the sensing interface not showing up.