We have a sensor that is reporting "Missed packet count" events. Can someone please post an explaination of this event? It does not seem to be on the Cisco web site or in the NSDB
I have a sensor that was previously configured as token-ring. now the token ring card has been removed and an ethernet card installed. How do i reconfigure solaris x86 to recognize the new card. The touch /reconfigure incantation does not appear t...
I have always thought that if I put a network in the "Protected Network" list that this meant the sensor would only care about these addresses. If this is the case then why does my sensor still report events from/to IP's not in this list. If it doe...
We have several sensors at the 3.0(5)S17 level that are reporting net sweep echo (2100) events with a source and/or destination IP of 0.0.0.0. How is this possible? Is this a bug?
I have several 2.5 (1) S3 sensors that have daemons that die for no apparent reason. nrstop/nrstart will get then going again. sap and filexfer seem to be the ones with problems. It also only seems to happen on my heavily used sensors.Thanks,Dan
I'm trying to use a network of 123.456.0.0 with a mask of 255.255.0.0. nrConfigure puts in is as RecordOfInternalAddress 123.456.0.0/16 which seems correct to me. You can have more than 1 RecordOfInternalAddress right? I have several network defin...
I implemented your suggestion for excluding events from all outside addresses ie: RecordOfExcludedPattern * * OUT OUT. However I have concern that now the sensor is not reporting anything. What is the format of the address/netmask for the RecordOfI...