TCPDump question...not working

T

thecoffeeguy

Hey everyone.

Have a question in regards to running tcpdump(1) on a 8.2 box.

I installed 8.2 on a Dell 2950 that has multiple processors and 8 gigs of memory, as well as dual onboard NIC's.

I configured the first NIC with an IP address, and left the second NIC alone, as I want to set this box up eventually as a Snort box.

Anyway, when I run a tcpdump(1) session on the second NIC (and a monitor session has been enabled on the switch it is connected to), I don't see any traffic. Very odd. $ ifconfig -a shows 'media: Ethernet autoselect', and port light is on on the switch).

However, when I run a tcpdump(1) on the first NIC, it works.

I have yet to compile a kernel or update the ports tree. I wanted to run this test first to make sure it works.

Any ideas on what the issue could be?

Thx
 
thecoffeeguy said:
Anyway, when I run a tcpdump session on the second NIC (and a monitor session has been enabled on the switch it is connected to), I dont see any traffic. Very odd. ( ifconfig -a shows 'media: Ethernet autoselect', and port light is lite on the switch).
Click to expand...
Have you tried sniffing on that switch port ?
 
Been trying to figure this out as it really does not make sense.
Perhaps I need to compile a custom kernel?
Both NICs are detected.

I installed 8.2 i386 accidentally on this box, but that should not make a difference should it?

Searching my brain, but this does not make sense to me.
 
You shouldn't need to compile a custom kernel. It also doesn't matter if you use i386, amd64 or sparc, it all works the same.

Make sure the interface is up, it doesn't need an IP address.
 
SirDice said:
You shouldn't need to compile a custom kernel. It also doesn't matter if you use i386, amd64 or sparc, it all works the same.

Make sure the interface is up, it doesn't need an IP address.
Click to expand...

Got it....just figured it out right before you posted. hhehe


All I did was $ ifconfig bce1 up

That did the trick.

Now, I am wondering if I should install 8.2 64 bit
Running i386 right now, but 8gigs of memory.

Suggestions?

Appreciate all the help.

TCG
 
phoenix said:
If you want to use more than 4 GB of RAM, you need to install the 64-bit (amd64) version. Otherwise, remove the extra 4 GB from the box.
Click to expand...

Ya, I decided to reinstall amd64 to use the extra memory. Felt like it would be a waste.

Appreciate it.
 
You must log in or register to reply here.
Back
Top