Problems with NTA traffic probe

[jcking]

Hello, I don´t receive probe statistics

I have the IMC Enterprise, this include the NTA with the probe software for non Sflow capable equipment.

I follow the instructions in the NTA_How_to_videos for  Typical Application-Probe Traffic. y set the port mirroring and conect the monitor port to the eth1 in my Red Hat server, and the eth0 in the same subnet that the IMC. install the probe AS 5.0 in a Red Hat server  with to network cards and select the eth1 to receive the traffic. The IMC is configured for recibe Probe Traffic, but i didn´t receive any traffic or reports. I put a sniffer in the monitor port and i see all the mirrored traffic

Does the interface eth1 have to have ip?

Do you need to do something else to the other interface (eth0)?

How the RedHat server knows where to send the reports?

this is my redhat server

# uname -a


Linux localhost.localdomain 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686 i686 i386 GNU/Linux


 

# cat /etc/redhat-release


Red Hat Enterprise Linux Server release 5 (Tikanga)


 

# ifconfig


eth0      Link encap:Ethernet  HWaddr 00:30:84:77:54:7D


          inet addr:192.168.1.158  Bcast:192.168.1.255  Mask:255.255.255.0


          inet6 addr: fe80::230:84ff:fe77:547d/64 Scope:Link


          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1


          RX packets:150984 errors:0 dropped:0 overruns:0 frame:0


          TX packets:16640 errors:0 dropped:0 overruns:0 carrier:0


          collisions:0 txqueuelen:1000


          RX bytes:12766093 (12.1 MiB)  TX bytes:4623237 (4.4 MiB)


          Interrupt:5 Base address:0xf00





eth1      Link encap:Ethernet  HWaddr 00:C0:A8:F5:CC:1A             <-------------------- receibe by dhcp


          inet addr:192.168.1.111  Bcast:192.168.1.255  Mask:255.255.255.0


          inet6 addr: fe80::2c0:a8ff:fef5:cc1a/64 Scope:Link


          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1


          RX packets:4445445 errors:0 dropped:0 overruns:0 frame:0


          TX packets:696 errors:0 dropped:0 overruns:0 carrier:0


          collisions:0 txqueuelen:1000


          RX bytes:946607535 (902.7 MiB)  TX bytes:34715 (33.9 KiB)

# ps -ax | grep probe


Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ


 2335 ?        Sl     0:02 /usr/local/unba/bin/probe


 5866 pts/2    R+     0:00 grep probe

and this is my switch 3com 5500

display mirroring-group 1


mirroring-group 1:


    type: local


    status: active


    mirroring port:


        GigabitEthernet1/0/1  both


    monitor port: GigabitEthernet1/0/6

[jcking]

The problem is resolved.

In the port that receives the mirrored traffic, I configure whatever ip, and in the other interface i put the same ip that is in the imc; check the traffic in that interface and every couple of minutes i see some ftp request´s from the imc server. the grap and the estadistics takes like 30 min to appear in the imc probe.