1) we are using 1 fiber monitoring port only. In the interface sensing group 0, it automatically detected int2 and int3. Do I need to remove 1 of them?
If you only want to monitor int2, then it becomes a question of what is being seen on int3. If int3 is not plugged in, then leaving it in the group presents no problems. If int3 is plugged into the switch and getting packets, then the extra packets will be monitored and could cause additional alarms to happen. In this case it is best to go ahead and remove int3 from the group so you don't get extra alarms you don't want.
2) CLI shows both int2 and int3 are up, but link status is down. What could be the problem? The switch port shows it is in monitoring status.
Haven't seen this problem before.
If the Span or VACL Capture is removed from the port, does the link show as Up?
Are the interfaces enabled (no shutdown) on the sensor as well as being in group 0?
Are the packet counts increasing on the 2 interfaces (if packet counts increase then the link must be up)
3) how to determine the interface name? ifconfig -a and dmesg only shows eth0 and eth1. If I try tcpdump -i int2 or tcpdump -i falcon1, it returns no such device.
Any suggestions will be appreciated. Thanks.
tcpdump can not be used to monitor the XL interfaces.
A special falcondump executable must be used, but it requires stopping cids (directions for using falcondump were posted in this Forum some time in the past).
This is changing for the next major version.
You could try using Iplogging for a particular IP Address to see if the sensor is seeing packets.
An easy way to see if an interface is getting packets is to look at the interface statistics and see if the packet counts are increasing for the intersaces.
