[Snort-users] network card shutting itself down <slight off topic>

Cedric Amand mailing-lists at ...134...
Sat Jul 22 06:12:32 EDT 2000


      It might be very specific to my config, by since I can't find
      either a reason or a solution to this Snort related problem, its
      a bit off topic but I thought maybe someone could have heard
      of this.

      WHile sniffing traffic, after a few days, my netwok card shuts
      itself down. The interface is reported as "up" by linux, but the
      green light is off, the link is off, and obviously there is no
      trafic to see anymore. I've whitnessed this with either 3C905,
      3C590 and Intel Etherexpress cards on two different systems.

      My config is sniffing "port mirroring" on a switch, 100Mbps full
      duplex, handling around 50Mbps. (And dropping a lot of packets ;)

      Some people suggested that it might be related to the fact that
      what I'm sniffing is 100% unidirectional (I'll only get pakcets
      from there, I can't talk or emit packets to that interface.)

      Other people suggested that I should be using a monster network
      card with much much more inbound cache since my traffic can
      easily kill the onboard buffers.

      Another people read about someone having the exact same problem
      on the same config in FreeBSD mailing lists, and also suggested
      to upgrade the network card to something serious "like intel",
      which proved to be just as cap as the other cards or me.

Best regards,
 Cedric                            mailto:mailing-lists at ...134...

More information about the Snort-users mailing list