VLAN Tagged Traffic - Some being missed

["Aaron" <snort () microchp org>]

Is there a trick to capturing traffic on Cisco capture ports?  

As Cisco is dropping "mirror" ports and going to capture ports, I now 
see vlan tagged traffic.  The network folks will not let me use mirror 
ports any more since Cisco is removing that in future releases of 
their IOS, from what I hear.

The problem is, that in that scenerio, I/Snort only see some of the 
traffic.  Tcpdump also drops many of the packets.

38 packets captured
1414426 packets received by filter
1408138 packets dropped by kernel

That is using libpcap 0.8.3 and tcpdump 3.8.3.  Using older versions 
of libpcap and tcpdump, I see the vlan tags in the output.  The latest 
version does not show them.  Neither seems to capture all.

This is on a circuit pushing about 500 megs of traffic.  Even on the 
sensors that only have less than 100 megs of traffic I get the same 
results and about the same loss.

The snort sensors are dual P4 xeon 2.8Ghz boxes with 1GB ram and 
ultra3 scsi disks.  I am using barnyard 0.2.0-rc2, not that it makes a 
diff. Info only.

Does it matter that I am getting traffic from multiple vlans?  Can 
Snort handle that?


Regards,

Aaron



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users