Network Monitoring issues - Solved

Hydrix · Last edited by Hydrix on Fri May 12, 2006 8:04 pm; edited 1 time in total

Hello, I have added a gentoo box on our office network for monitoring purposes, and it has been a very powerful tool for me using iptraf and nethogs.

However, recently, it stopped working. It appears now that the system will only show traffic that is being sent to or from this machine, and is no longer displaying all information from the network.

This has happened on a similar box on my home network aswell. Was something changed? I have verified that iptraf is still in promiscous mode, however, it is just not working like it did before.

Thanks in advance,

Jeff

widan · Posted: Tue May 09, 2006 10:19 pm Post subject: Re: Network Monitoring issues

Hydrix · Posted: Wed May 10, 2006 8:08 pm Post subject:

There was no change in the network equipment. This monitoring computer is attached to a hub that sits between our DSL router and our internal firewall/router (Microsoft ISA server). The monitoring computer originally could see all traffic between our ISA server and the DSL router.

This appeared to stop working after doing an emerge --update about 2 weeks ago. I am very new to Linux, so I am certain that it was something I have done.

Hydrix · Posted: Wed May 10, 2006 8:30 pm Post subject:

It appears as if recently some configuration option was changed to not allow the NIC to recieve packets for which it is not the destination?

I am getting these same results using any software that sniffs the packets off the network. They are only seeing packets going to/from this machine. Was some default configuration option changed to disable this functionality?

I am certainly lost here, things were working great until recently.

widan · Posted: Wed May 10, 2006 9:10 pm Post subject:

Hydrix · Posted: Wed May 10, 2006 10:06 pm Post subject:

thepustule · Posted: Thu May 11, 2006 3:47 pm Post subject:

Have you tried a different hub?

I have a weird hub here that sometimes behaves switch-like. Especially when you have one machine on 10megabit and another on 100.

Hydrix · Posted: Thu May 11, 2006 4:24 pm Post subject:

I have not tried a different hub, as it didnt seem likely that both of monitoring boxes hubs stopped working. These two systems are at two seperate locations, on two seperate networks. Both are acting the same.

I have acutally just tried this on 3 other computers and it is not working on any computer that has been updated in the past month or so. It is working fine on an older box. Im so confused.

I will try to replace the hub and see what difference this makes.

Thanks.

thepustule · Posted: Thu May 11, 2006 4:36 pm Post subject:

Yeah that makes sense - unlikely it is the hub if it is happening everywhere.

I'll tell you one thing - I'll be waiting for a while before upgrading the core stuff. The recent php and openvpn changes have been enough to deal with

Hydrix · Posted: Fri May 12, 2006 8:06 pm Post subject:

Well I am not entirely sure what fixed it, I have made many configuration changes today with nothing making a difference. Then i go back to move it to my original hub, and found that I had replaced the hub with a switch yesterday (why does linksys make their 4 port switches so small cute and hublike). After re-routing cabling to the old hub everythign is working. It could have been one of the many configuration changes I made today or yesterday.