[Snort-users] network card shutting itself down <slight off topic>

Martin Roesch roesch at ...1...
Sun Jul 23 18:03:15 EDT 2000


If you haven't got the $$$ for the Intel cards, the NetGear FA310TX is
inexpensive and performs well (not great, *well*).  It's the NIC of choice
here at Snort Labs. :)

     -Marty

Jeff Nathan wrote:
> 
> Hi Guys.
> 
> I wanted to preface this response by saying "I'm really biased against
> the 3Com 3c905 card".  Now then, with that be said I wanted to suggest
> downing the interface and then bring it back up.  That _might_ help.
> I've also seen suggestions to use the Intel EtherExpress card, which is
> indeed a great card (I85229 chipset cards rock!) and tends to have great
> driver support.  In the course of (ahem) performance testing some
> network equipment, I've seen a boatload of 3Com 3c905 cards go belly up.
> 
> Jerry Shenk wrote:
> >
> > I don't have a solution but I do have the same problem.  In this case, my
> > 'problem box' is a 486/66 with a 3c509.  I whipped up a workaround script
> > that checks for IP connectivity with 4 hosts and if they're all down, it
> > fixes the problem.  Initially, I 'fixed the problem' with
> > '/etc/rc.d/init.d/network restart' but that seemed to only work for a couple
> > hours, maybe a day.  I recently changed that to 'shutdown -r now' and that
> > seems to be doing better...that is, I get a week between problems now.  On
> > this system, the traffic is not the problem, it's a DSL line which is a LOT
> > slower than what you have and it doesn't seem to be dropping when traffic is
> > particularly high.  In my case, obviously the whole box could (should?) be
> > replaced but.....  Ya know, as I'm thinking about this, I've had this happen
> > on my home box also which is also a 486/66 but more importantly, it also has
> > a 3c509 that's giving me the problem....the other NIC (at home) is something
> > else (I forget) and it never gives me a problem.  This is beginning to sound
> > like a NIC problem to me.
> >
> > ----- Original Message -----
> > From: "Cedric Amand" <mailing-lists at ...134...>
> > To: "snort-users" <snort-users at lists.sourceforge.net>
> > Sent: Saturday, July 22, 2000 6:12 AM
> > Subject: [Snort-users] network card shutting itself down <slight off topic>
> >
> > > Hello,
> > >
> > >       It might be very specific to my config, by since I can't find
> > >       either a reason or a solution to this Snort related problem, its
> > >       a bit off topic but I thought maybe someone could have heard
> > >       of this.
> > >
> > >       WHile sniffing traffic, after a few days, my netwok card shuts
> > >       itself down. The interface is reported as "up" by linux, but the
> > >       green light is off, the link is off, and obviously there is no
> > >       trafic to see anymore. I've whitnessed this with either 3C905,
> > >       3C590 and Intel Etherexpress cards on two different systems.
> > >
> > >       My config is sniffing "port mirroring" on a switch, 100Mbps full
> > >       duplex, handling around 50Mbps. (And dropping a lot of packets ;)
> > >
> > >       Some people suggested that it might be related to the fact that
> > >       what I'm sniffing is 100% unidirectional (I'll only get pakcets
> > >       from there, I can't talk or emit packets to that interface.)
> > >
> > >       Other people suggested that I should be using a monster network
> > >       card with much much more inbound cache since my traffic can
> > >       easily kill the onboard buffers.
> > >
> > >       Another people read about someone having the exact same problem
> > >       on the same config in FreeBSD mailing lists, and also suggested
> > >       to upgrade the network card to something serious "like intel",
> > >       which proved to be just as cap as the other cards or me.
> > >
> > > --
> > > Best regards,
> > >  Cedric                            mailto:mailing-lists at ...134...
> > >
> > >
> > >
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users at lists.sourceforge.net
> > > http://lists.sourceforge.net/mailman/listinfo/snort-users
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > http://lists.sourceforge.net/mailman/listinfo/snort-users
> 
> --
> Jeff Nathan                          <jeff at ...2...>
> Core R&D                         http://www.hiverworld.com
> Hiverworld, Inc.       Continuous Adaptive Risk Management
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users

-- 
Martin Roesch                      <roesch at ...2...>
Core R&D                         http://www.hiverworld.com
Hiverworld, Inc.       Continuous Adaptive Risk Management




More information about the Snort-users mailing list