[Snort-users] network card shutting itself down <slight off topic>

Jeff Nathan jeff at ...2...
Sat Jul 22 22:22:04 EDT 2000

Hi Guys.

I wanted to preface this response by saying "I'm really biased against
the 3Com 3c905 card".  Now then, with that be said I wanted to suggest
downing the interface and then bring it back up.  That _might_ help. 
I've also seen suggestions to use the Intel EtherExpress card, which is
indeed a great card (I85229 chipset cards rock!) and tends to have great
driver support.  In the course of (ahem) performance testing some
network equipment, I've seen a boatload of 3Com 3c905 cards go belly up.

Jerry Shenk wrote:
> I don't have a solution but I do have the same problem.  In this case, my
> 'problem box' is a 486/66 with a 3c509.  I whipped up a workaround script
> that checks for IP connectivity with 4 hosts and if they're all down, it
> fixes the problem.  Initially, I 'fixed the problem' with
> '/etc/rc.d/init.d/network restart' but that seemed to only work for a couple
> hours, maybe a day.  I recently changed that to 'shutdown -r now' and that
> seems to be doing better...that is, I get a week between problems now.  On
> this system, the traffic is not the problem, it's a DSL line which is a LOT
> slower than what you have and it doesn't seem to be dropping when traffic is
> particularly high.  In my case, obviously the whole box could (should?) be
> replaced but.....  Ya know, as I'm thinking about this, I've had this happen
> on my home box also which is also a 486/66 but more importantly, it also has
> a 3c509 that's giving me the problem....the other NIC (at home) is something
> else (I forget) and it never gives me a problem.  This is beginning to sound
> like a NIC problem to me.
> ----- Original Message -----
> From: "Cedric Amand" <mailing-lists at ...134...>
> To: "snort-users" <snort-users at lists.sourceforge.net>
> Sent: Saturday, July 22, 2000 6:12 AM
> Subject: [Snort-users] network card shutting itself down <slight off topic>
> > Hello,
> >
> >       It might be very specific to my config, by since I can't find
> >       either a reason or a solution to this Snort related problem, its
> >       a bit off topic but I thought maybe someone could have heard
> >       of this.
> >
> >       WHile sniffing traffic, after a few days, my netwok card shuts
> >       itself down. The interface is reported as "up" by linux, but the
> >       green light is off, the link is off, and obviously there is no
> >       trafic to see anymore. I've whitnessed this with either 3C905,
> >       3C590 and Intel Etherexpress cards on two different systems.
> >
> >       My config is sniffing "port mirroring" on a switch, 100Mbps full
> >       duplex, handling around 50Mbps. (And dropping a lot of packets ;)
> >
> >       Some people suggested that it might be related to the fact that
> >       what I'm sniffing is 100% unidirectional (I'll only get pakcets
> >       from there, I can't talk or emit packets to that interface.)
> >
> >       Other people suggested that I should be using a monster network
> >       card with much much more inbound cache since my traffic can
> >       easily kill the onboard buffers.
> >
> >       Another people read about someone having the exact same problem
> >       on the same config in FreeBSD mailing lists, and also suggested
> >       to upgrade the network card to something serious "like intel",
> >       which proved to be just as cap as the other cards or me.
> >
> > --
> > Best regards,
> >  Cedric                            mailto:mailing-lists at ...134...
> >
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > http://lists.sourceforge.net/mailman/listinfo/snort-users
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users

Jeff Nathan                          <jeff at ...2...>
Core R&D                         http://www.hiverworld.com
Hiverworld, Inc.       Continuous Adaptive Risk Management

More information about the Snort-users mailing list