What are the recommended settings for an unaddressed network capture interface?

Solution Verified - Updated -

Issue

Trying to deploy the IBM TeaLeaf network session capture application in Red Hat Enterprise Linux 6.

The application listens on an unaddressed interface in promiscuous mode and captures all traffic to reassemble sessions for monitoring and auditing purposes.

It was working on Red Hat Enterprise Linux 5, but on version 6 with a 10GbE Ethernet adapter, the software is seeing corrupt sessions which IBM states is due to missing packets.

There's no indication from the network stack (ifconfig and netstat) that anything is being dropped.

Environment

  • Red Hat Enterprise Linux 6
  • Intel 10G Ethernet interface (ixgbe)
  • No address configured on network interface

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In