True, you should never see the sniffing interface when using the "ifconfig -a" command.
To see if the interface is seeing packets try executing the following commands:
On the 4210 as user root: "snoop -d iprb0"
On the 4230 as user root: "snoop -d spwr0"
You may also want to check the NameOfPacketDevice configuration in the /usr/nr/etc/packetd.conf file on the sensors:
On the 4210 in packetd.conf: "NameOfPacketDevice /dev/iprb0"
On the 4230 in packetd.conf: "NameOfPacketDevice /dev/spwr0"
If these interface names are incorrect they can be corrected in CSPM, and have the new configuration pushed to the sensor. Check to ensure that the configuration is now correct on the sensors. You may need to execute "nrstop" and "nrstart" to ensure that all of the IDS programs are started. Also run "nrvers" to ensure that all the IDS programs are responding to the query for the version information.
Once you have ensured that all of the programs are running, the correct configuration is being used, packets are being seen by the snoop command, then you should see any alarms being gernerated by the sensors.
I would recommend generating a specific alarm to see if it is being seen. Generally poeple create a custom signature to do this type of verification such as the string "Test Sensor" on a telnet connection.
