Xymon Mailing List Archive search

Trending Interfaces without IP addresses

8 messages in this thread

list Conrad Rockenhaus · Wed, 11 Aug 2010 11:28:48 -0400 · 
Hello,

I have several IDS sensors that I would like to take bandwidth snapshots of
the IDS interface.  I noticed that the ifstat command to grab the statistics
only grabs statistics for the interface with an IP address assigned to it; I
have tried modifying it to grab the statistics for the unnumbered interface,
but it still does not return any data.  The sensors run FreeBSD.

So, does anyone know of a way to get Xymon to gather statistics of an
interface that is up with an active link (one-way tap) but does not have an
IP address?

Thanks,

Conrad
list Bill Arlofski · Wed, 11 Aug 2010 11:34:59 -0400 ·
▸ quoted from Conrad Rockenhaus
On 08/11/10 11:28, Conrad Rockenhaus wrote:
Hello,

I have several IDS sensors that I would like to take bandwidth snapshots of
the IDS interface.  I noticed that the ifstat command to grab the statistics
only grabs statistics for the interface with an IP address assigned to it; I
have tried modifying it to grab the statistics for the unnumbered interface,
but it still does not return any data.  The sensors run FreeBSD.

So, does anyone know of a way to get Xymon to gather statistics of an
interface that is up with an active link (one-way tap) but does not have an
IP address?

Thanks,

Conrad

Hi Conrad... Why not just monitor the ethernet port on the switch the IDS is
plugged into?


-- 
Bill Arlofski
Reverse Polarity, LLC
list Conrad Rockenhaus · Wed, 11 Aug 2010 13:09:46 -0400 ·
▸ quoted from Bill Arlofski
On Wed, Aug 11, 2010 at 11:34 AM, Bill Arlofski <user-0b8af203a56e@xymon.invalid>wrote:

On 08/11/10 11:28, Conrad Rockenhaus wrote:
Hello,

I have several IDS sensors that I would like to take bandwidth snapshots
of
the IDS interface.  I noticed that the ifstat command to grab the
statistics
only grabs statistics for the interface with an IP address assigned to
it; I
have tried modifying it to grab the statistics for the unnumbered
interface,
but it still does not return any data.  The sensors run FreeBSD.

So, does anyone know of a way to get Xymon to gather statistics of an
interface that is up with an active link (one-way tap) but does not have
an
IP address?

Thanks,

Conrad

Hi Conrad... Why not just monitor the ethernet port on the switch the IDS
is
plugged into?


--
Bill Arlofski
Reverse Polarity, LLC

Hi Bill,

Unfortunately, do not have that option - I have no direct communications
between that switch and the LAN that Xymon resides on, and getting
communications between the switches that are spanning to the IDS and Xymon
isn't going to be feasible.  Only way to monitor the metrics of what I'm
capturing is to utilize the in packet counter on the IDS interface.

Thanks,

Conrad
list Craig Cook · Wed, 11 Aug 2010 13:25:54 -0400 · 
Can you alter the data at the source?  i.e. hack the result of the netstat command to include a "fake" IP address.  Use perl/sed/awk/etc to insert a line with an IP address.  The client will then send the data to the server to process as a new interface.

Craig
list Ralph Mitchell · Wed, 11 Aug 2010 17:57:01 -0400 · 
Does "ifconfig -a" give you anything you can use??

Ralph Mitchell
▸ quoted from Craig Cook


On Wed, Aug 11, 2010 at 1:25 PM, Craig Cook <user-850f03189cf7@xymon.invalid> wrote:

Can you alter the data at the source?  i.e. hack the result of the netstat
command to include a "fake" IP address.  Use perl/sed/awk/etc to insert a
line with an IP address.  The client will then send the data to the server
to process as a new interface.

Craig
list Maik Heinelt · Thu, 12 Aug 2010 13:43:29 +0900 · 
  Might be a stupid question, but I was looking for the Xymon 
mailing-list subscribe address and wasn't able to find it anywhere.

To unsubscribe, I have to use this on: xymon-unsubscribe at xymon.com 
<mailto:xymon-unsubscribe at xymon.com> .

Even on xymon.com, I only found the mailinglist archive.

I would like to add this subscribe address, on my own page.
Or if someone have the mailman subscribe page link, would be perfect!


Maik
list Rob MacGregor · Thu, 12 Aug 2010 07:37:47 +0100 ·
▸ quoted from Maik Heinelt
On Thu, Aug 12, 2010 at 05:43, Maik Heinelt <user-4ab5eb34adb2@xymon.invalid> wrote:
Might be a stupid question, but I was looking for the Xymon mailing-list subscribe address and wasn't able to find it anywhere.
Shown in the headers of every list message:


--
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche
list Jerald Sheets · Thu, 12 Aug 2010 07:57:59 -0400 · 
I don't think Henrik had an opportunity to update his old page yet:

http://www.hswn.dk/hobbit/help/about.html#mailinglists

Just substitute "xymon" for every instance of "hobbit" you see in the subscribe/unsubscribe addresses, and you should be good to go.

--jms
▸ quoted from Rob MacGregor


On Aug 12, 2010, at 2:37 AM, Rob MacGregor wrote:

On Thu, Aug 12, 2010 at 05:43, Maik Heinelt <user-4ab5eb34adb2@xymon.invalid> wrote:
Might be a stupid question, but I was looking for the Xymon mailing-list subscribe address and wasn't able to find it anywhere.
Shown in the headers of every list message:


--
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche