4 Jul 2001 17:30
Re: Hi
Peter Van Epp <vanepp <at> sfu.ca>
2001-07-04 15:30:02 GMT
2001-07-04 15:30:02 GMT
You also want to patch your kernel with the bpf fix in FreeBSD PR kern/22063 (also available on qosient.com somewhere I believe) otherwise the kernel will quietly lose packets in partially filled buffers. The fix still isn't in in 4.3-RELEASE. For security (and safety) the Shomiti Century tap will isolate the TX lines of your monitor ports so even if the interface does respond to something it won't get back to the switch. You probably also want to boost the bpf buffer size to 32K (the max) in bpf.c while applying the patch (I don't believe that change is in the patch). Peter Van Epp / Operations and Technical Support Simon Fraser University, Burnaby, B.C. Canada > > Just downloaded and had a peek at Argus on our FreeBSD 4.3 box. > The box has 1 NIC for normal network, and 2 NIC that doesnt > have an IP and just silently monitors ports on our switch. > Tried to start up Argus but it complained > argus[87024]: ArgusInitSource: fxp1: no IPv4 address assigned > > Does Argus require an IP address for the NIC it will use or is > it any way to make this work? > > -- > Olav Langeland - olav.langeland <at> activeisp.com >
RSS Feed