tcpdump

[emusican]

On the cisco 4250XL's it shows 2 sniffing interfaces...int2 and int3. THe hardwar is falcon1 and falcon2.

I want to be able to view the traffic coming off of these interfaces.

On the old 3.x sensors I could use snoop, and specify the spwr interface to view this.

What is the 4.0 counterpart?

[pbobby]

Not having a falcon card myself.

But you can log in as root, and do an ifconfig -a. This will list all your interfaces.

And if you have 4.1.4 of the IDS software you can tcpdump whilst the IDS sensor is still running.

[emusican]

Those interfaces dont show up on ifconfig.

[mcerha]

The interfaces will not show up. To capture packets, you need to:

1) Log into the service account and su to root.

2) Run /etc/init.d/cids stop

3) Run /etc/init.d/falcon start

4) Run the falcondump command like this:

/usr/cids/idsRoot/bin/falcondump -o

5) Reboot the sensor when done.

This will result in a PCAP formatted output file that you can load into ethereal.

[vianet0]

is there not a way or other alternative of sniffing int0 ?

[emusican]

Do I HAVE to stop cids to use falcondump? What if I wanted to do an extended grep for a specific port (all traffic). Would I have to actully have to shut the IDS part off to do this?

[mlhall · Accepted solution]

In v5.0 you will be able to run tcpdump from the command line on all data interfaces including the XL/falcon ports. At this time, the driver for XL ports only allows the one consumer of packets at a time. So you get IDS or falcondump but not both.

[emusican]

Then I will wait anxiously for v5.0 to arrive!

..any idea when its coming out?

Thank for the workaround.