<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
You may wish to check the frame size on the Vpc matches what the nic is configured.
<br>
<br>
Run Ethtool on Intel server to set, see how large it'll go. Also, there are guides around for other settings to set/unset for capturing only<br>
<br>
Sh hardware internal naxos port n# state | grep MTU<br>
<br>
MRU/MTU: 9284 bytes, Rx-CRC-Mode: 4 bytes, Tx-CRC-Mode: 4 bytes<br>
<br>
Sh running-config all | grep jumbo<br>
system jumbomtu 9216<br>
<br>
<br>
On nexus to see what it's doing. <br>
<br>
You may (guessing) need to reduce jumbo size to support the maximum size of the of the capture nic, including the VPC overhead.
<br>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org> on behalf of Charles Devoe <Charles.Devoe@cisecurity.org><br>
<b>Sent:</b> 15 June 2017 15:05:04<br>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> [Oisf-users] Monitoring a VPC</font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">I have a system where we have tapped into 4 10gig uplinks in a VPC port-channel trunk. We are using intel X520 cards to get the traffic from the taps. These cards are showing a lot of CRC errors, frame error,
and rxerrors. Has anyone had experience taping a VPC connection and is there anything special I need to do.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-family:"Times New Roman",serif">Charles DeVoe Jr.</span></b><span style="font-family:"Times New Roman",serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif">Manager of Engineering<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif">Multi-State Information Sharing and Analysis Center (MS-ISAC) <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif">31 Tech Valley Drive<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif">East Greenbush, NY 12061<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif">charles.devoe@cisecurity.org<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif">(518) 266-3494<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif">7x24 Security Operations Center<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"><a href="mailto:SOC@cisecurity.org"><span style="color:#0563C1">SOC@cisecurity.org</span></a> - 1-866-787-4722<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"><img border="0" width="237" height="55" id="_x0000_i1029" src="cid:image001.png@01D2E5BE.DB75C0C0"></span><span style="font-family:"Times New Roman",serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"> </span>
<a href="https://www.facebook.com/CenterforIntSec"><span style="font-family:"Times New Roman",serif;color:windowtext;text-decoration:none"><img border="0" width="32" height="33" id="_x0000_i1028" alt="id:image002.png@01D2926D.D9CF2E90" src="cid:image002.png@01D2E5BE.DB75C0C0"></span></a><span style="font-family:"Times New Roman",serif"> </span><a href="https://twitter.com/CISecurity"><span style="font-family:"Times New Roman",serif;color:windowtext;text-decoration:none"><img border="0" width="32" height="33" id="_x0000_i1027" alt="id:image003.png@01D2926D.D9CF2E90" src="cid:image003.png@01D2E5BE.DB75C0C0"></span></a><span style="font-family:"Times New Roman",serif"> </span><a href="https://www.youtube.com/user/TheCISecurity"><span style="font-family:"Times New Roman",serif;color:windowtext;text-decoration:none"><img border="0" width="32" height="33" id="_x0000_i1026" alt="id:image004.png@01D2926D.D9CF2E90" src="cid:image004.png@01D2E5BE.DB75C0C0"></span></a><span style="font-family:"Times New Roman",serif"> </span><a href="https://www.linkedin.com/company/the-center-for-internet-security"><span style="font-family:"Times New Roman",serif;color:windowtext;text-decoration:none"><img border="0" width="32" height="33" id="_x0000_i1025" alt="id:image005.png@01D2926D.D9CF2E90" src="cid:image005.png@01D2E5BE.DB75C0C0"></span></a><span style="font-family:"Times New Roman",serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender
immediately and permanently delete the message and any attachments. <br>
<br>
. . . . . </div>
</body>
</html>