[Snort-users] network card shutting itself down <slight off topic>

Jerry Shenk jas at ...129...
Sat Jul 22 08:01:43 EDT 2000


I don't have a solution but I do have the same problem.  In this case, my
'problem box' is a 486/66 with a 3c509.  I whipped up a workaround script
that checks for IP connectivity with 4 hosts and if they're all down, it
fixes the problem.  Initially, I 'fixed the problem' with
'/etc/rc.d/init.d/network restart' but that seemed to only work for a couple
hours, maybe a day.  I recently changed that to 'shutdown -r now' and that
seems to be doing better...that is, I get a week between problems now.  On
this system, the traffic is not the problem, it's a DSL line which is a LOT
slower than what you have and it doesn't seem to be dropping when traffic is
particularly high.  In my case, obviously the whole box could (should?) be
replaced but.....  Ya know, as I'm thinking about this, I've had this happen
on my home box also which is also a 486/66 but more importantly, it also has
a 3c509 that's giving me the problem....the other NIC (at home) is something
else (I forget) and it never gives me a problem.  This is beginning to sound
like a NIC problem to me.

----- Original Message -----
From: "Cedric Amand" <mailing-lists at ...134...>
To: "snort-users" <snort-users at lists.sourceforge.net>
Sent: Saturday, July 22, 2000 6:12 AM
Subject: [Snort-users] network card shutting itself down <slight off topic>


> Hello,
>
>       It might be very specific to my config, by since I can't find
>       either a reason or a solution to this Snort related problem, its
>       a bit off topic but I thought maybe someone could have heard
>       of this.
>
>       WHile sniffing traffic, after a few days, my netwok card shuts
>       itself down. The interface is reported as "up" by linux, but the
>       green light is off, the link is off, and obviously there is no
>       trafic to see anymore. I've whitnessed this with either 3C905,
>       3C590 and Intel Etherexpress cards on two different systems.
>
>       My config is sniffing "port mirroring" on a switch, 100Mbps full
>       duplex, handling around 50Mbps. (And dropping a lot of packets ;)
>
>       Some people suggested that it might be related to the fact that
>       what I'm sniffing is 100% unidirectional (I'll only get pakcets
>       from there, I can't talk or emit packets to that interface.)
>
>       Other people suggested that I should be using a monster network
>       card with much much more inbound cache since my traffic can
>       easily kill the onboard buffers.
>
>       Another people read about someone having the exact same problem
>       on the same config in FreeBSD mailing lists, and also suggested
>       to upgrade the network card to something serious "like intel",
>       which proved to be just as cap as the other cards or me.
>
> --
> Best regards,
>  Cedric                            mailto:mailing-lists at ...134...
>
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users





More information about the Snort-users mailing list