Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

route down/up - please help/

I understand the alarm is generated based on network connectivity or not.

But, I'm seeing (in my log files) tenths of a second between a route up and then a route down. So fast, there not even registering on the director gui.

I examine the postoffice config files, but can't seem to find anything set to react like that.

In addition, how can I adjust this if I'm willing to accept (or at least have to accept) a few seconds of network latency due to possible traffic load.

Any help would be greatly appreciated.

Sensors are 3.0(5)S18 and director is 2.2.3 (S18).

Thank-you.

  • Other Security Subjects
3 REPLIES
Cisco Employee

Re: route down/up - please help/

Hi Jeff,

This may help...

On the sensor appliance, edit /usr/nr/etc/postofficed.conf file to add the following token:

HeartBeatIntervalMultiplier 12

Ward.

New Member

Re: route down/up - please help/

Thank you. I plan to make the change.

Would it be too much trouble to explain some details behind your response? I's like to at least have a good working understanding before I implement the change.

Thanks again.

Cisco Employee

Re: route down/up - please help/

Hi Jeff,

Via the postoffice protocol, the sensor sends a heartbeat message to the other CIDS machines it's communicating with. The acknowledgement to this message is the sensor's indication that the route is "up". There's a timeout value that the sensor uses to wait for the response before it declares the route as "down". This timeout is HeartBeatIntervalMultiplier x HeartBeat seconds.

The default HeartBeatIntervalMultiplier is 3 and the default HeartBeat is 5 seconds. So, by increasing the HeartBeatIntervalMultiplier, you're configuring the sensor to wait longer for the response to the heartbeat message that it sent before declaring a "route down" to the corresponding CIDS machine.

Ward.

94
Views
0
Helpful
3
Replies
This widget could not be displayed.