Re: [sentinix-list] bound NIC's

Don't understand this one.  I know the dl360's Intel NICs have some bug in 
them though, but I doubt that would be of any problem here.

However, you _should_ enable netfilter (iptables) to _drop_ all traffic coming 
in on eth0, although routing isn't enabled by default, that won't be a 
problem, but you may get other problems, especially since the NIC is placed 
in "promiscuous mode" by the sniffer.  A line like this in 
/etc/rc.d/rc.firewall might do it:

iptables -t mangle -A PREROUTING -i eth0 -j DROP

PREROUTING and -i eth0 means it's coming in to the box and is handled by 
Netfilter before any routing (unlike the INPUT chain).

	Michel

On Tuesday 30 December 2003 19:43, M. Morgan wrote:
> Bill,
>  I dont have an answer to that question but I'm going to attempt the same
> thing on a dual NIC pc here tomorrow. If you find the answer please post it
> and I'll do the same.
>
> Thanks,
> Michael
>
> -----Original Message-----
> From: "OMalley, Bill" <Bill.OMalley-3ekG96uVUrBWk0Htik3J/[email protected]>
> Sent: Dec 29, 2003 5:26 PM
> To: The SENTINIX Mailing List <[email protected]>
> Subject: [sentinix-list] bound NIC's
>
> I've set up Sentinix on a Compaq DL360 with dual Network Interfaces.  My
> intention was to use eth0 as the monitoring port and eth1 as the
> administration port.  Access to eth0 would not be allowed once it is on a
> spanned port on a Cisco 3550.
>
> My problem here is that somehow both NIC's on the server are acting as one.
>  If I spann the one port on the switch (to eth0), access to both NIC's is
> unavailable.
>
> Has anyone seen this before?  If so, how would I go about un-binding the
> two NIC's?
>
> Thanks for any help you can offer.
>
> Regards,
> Bill O'Malley
>
>
>
> THIS MESSAGE MAY CONTAIN INFORMATION THAT IS CONFIDENTIAL AND/OR PROTECTED
> BY LAW. IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, YOU
> ARE HEREBY NOTIFIED THAT ANY DISSEMINATION, DISTRIBUTION, COPYING OR
> COMMUNICATION OF THIS MESSAGE IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED
> THIS COMMUNICATION IN ERROR, PLEASE  CONTACT  THE SENDER IMMEDIATELY AND
> DELETE THE MESSAGE.  PLEASE NOTE THAT  ALTHOUGH WE WILL TAKE ALL
> COMMERCIALLY REASONABLE EFFORTS TO PREVENT VIRUSES FROM BEING TRANSMITTED
> FROM OUR SYSTEMS, IT IS THE RESPONSIBILITY OF THE RECIPIENT TO CHECK FOR
> AND PREVENT ADVERSE ACTION BY VIRUSES ON ITS OWN SYSTEMS .
>
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix