[Snort-users] network card shutting itself down <slight off topic>
bruneau at ...126...
Sat Jul 22 08:40:33 EDT 2000
I think you should try an Intel EtherExpress PRO/100 PCI card since it has a
bigger buffer. That should cured your problem
Jerry Shenk wrote:
> I don't have a solution but I do have the same problem. In this case, my
> 'problem box' is a 486/66 with a 3c509. I whipped up a workaround script
> that checks for IP connectivity with 4 hosts and if they're all down, it
> fixes the problem. Initially, I 'fixed the problem' with
> '/etc/rc.d/init.d/network restart' but that seemed to only work for a couple
> hours, maybe a day. I recently changed that to 'shutdown -r now' and that
> seems to be doing better...that is, I get a week between problems now. On
> this system, the traffic is not the problem, it's a DSL line which is a LOT
> slower than what you have and it doesn't seem to be dropping when traffic is
> particularly high. In my case, obviously the whole box could (should?) be
> replaced but..... Ya know, as I'm thinking about this, I've had this happen
> on my home box also which is also a 486/66 but more importantly, it also has
> a 3c509 that's giving me the problem....the other NIC (at home) is something
> else (I forget) and it never gives me a problem. This is beginning to sound
> like a NIC problem to me.
> ----- Original Message -----
> From: "Cedric Amand" <mailing-lists at ...134...>
> To: "snort-users" <snort-users at lists.sourceforge.net>
> Sent: Saturday, July 22, 2000 6:12 AM
> Subject: [Snort-users] network card shutting itself down <slight off topic>
> > Hello,
> > It might be very specific to my config, by since I can't find
> > either a reason or a solution to this Snort related problem, its
> > a bit off topic but I thought maybe someone could have heard
> > of this.
> > WHile sniffing traffic, after a few days, my netwok card shuts
> > itself down. The interface is reported as "up" by linux, but the
> > green light is off, the link is off, and obviously there is no
> > trafic to see anymore. I've whitnessed this with either 3C905,
> > 3C590 and Intel Etherexpress cards on two different systems.
> > My config is sniffing "port mirroring" on a switch, 100Mbps full
> > duplex, handling around 50Mbps. (And dropping a lot of packets ;)
> > Some people suggested that it might be related to the fact that
> > what I'm sniffing is 100% unidirectional (I'll only get pakcets
> > from there, I can't talk or emit packets to that interface.)
> > Other people suggested that I should be using a monster network
> > card with much much more inbound cache since my traffic can
> > easily kill the onboard buffers.
> > Another people read about someone having the exact same problem
> > on the same config in FreeBSD mailing lists, and also suggested
> > to upgrade the network card to something serious "like intel",
> > which proved to be just as cap as the other cards or me.
> > --
> > Best regards,
> > Cedric mailto:mailing-lists at ...134...
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > http://lists.sourceforge.net/mailman/listinfo/snort-users
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
More information about the Snort-users