From owner-freebsd-questions@FreeBSD.ORG Thu Feb 25 16:10:09 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 76268106566B for ; Thu, 25 Feb 2010 16:10:09 +0000 (UTC) (envelope-from urbanski@vt.edu) Received: from saruman.cc.w2k.vt.edu (saruman.cc.vt.edu [198.82.160.23]) by mx1.freebsd.org (Postfix) with ESMTP id 2EC5B8FC13 for ; Thu, 25 Feb 2010 16:10:09 +0000 (UTC) Received: from fangorn.cc.w2k.vt.edu ([198.82.160.35]) by saruman.cc.w2k.vt.edu ([198.82.160.23]) with mapi; Thu, 25 Feb 2010 10:59:49 -0500 From: "Urbanski, William" To: "'freebsd-questions@freebsd.org'" Date: Thu, 25 Feb 2010 10:59:48 -0500 Thread-Topic: bonding NICs with netgraph Thread-Index: Acq2M40BL2Xy/Pw+ThC+n9vJX4QfnA== Message-ID: <9A646756E263F34F8AC6F88883AA825025A0D312D8@fangorn.cc.w2k.vt.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Subject: bonding NICs with netgraph X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Feb 2010 16:10:09 -0000 Hi, I am setting up a freebsd box to act as a snort sensor on a network. Th= e box has three nics, one internal nic for talking on the network and to th= e management server, and two nics on a single pci card that each connect to= SPAN ports on my switch. I am trying to bind the two adapters on the freeb= sd box so I have one virtual adapter that snort can listen to. I have been researching netgraph for some time and the script I have been u= sing to configure the adapters is: Code: #!/bin/sh echo "Trying kldload ng_ether..." kldload ng_ether echo "Putting dual adapters into promisc mode..." ifconfig em0 promisc -arp up ifconfig em1 promisc -arp up echo "Trying mkpeer . eiface hook ether" ngctl mkpeer . eiface hook ether echo "Trying mkpeer ngeth0: one2many lower one" ngctl mkpeer ngeth0: one2many lower one echo "Trying ngctl connect em0: ngeth0: lower lower many0" ngctl connect em0: ngeth0:lower lower many0 echo "Trying ngctl connect em1: ngeth0: lower lower many1" ngctl connect em1: ngeth0:lower lower many1 echo "Tryinh ifconfig ngeth0 -arp up" ifconfig ngeth0 -arp up However when I run the script I get: Code: Trying kldload ng_ether... Putting dual adapters into promisc mode... Trying mkpeer . eiface hook ether Trying mkpeer ngeth0: one2many lower one ngctl: send msg: Protocol family not supported Trying ngctl connect em0: ngeth0: lower lower many0 ngctl: send msg: No such file or directory Trying ngctl connect em1: ngeth0: lower lower many1 ngctl: send msg: No such file or directory Tryinh ifconfig ngeth0 -arp up Now 'ngeth0' appears in ifconfig: Code: ngeth0: flags=3D88c3 metric 0= mtu 1500 ether 00:00:00:00:00:00 but when I TCPDUMP from it it never records any packets even though I know = the span ports are sending the individual NICs data. I have been googling the error messages that are returned by the bonding sc= ript but have been unable to get packets to cross ngeth0. Any advice or tip= s for troubleshooting this would be greatly appreciated. Thank you in advan= ce. Will Urbanski