<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Arial",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head><body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I have a Dell R630 system with an Intel X710 DP 10 GB DA/SFP+ + I350 DP 1GB Daughter card and an Intel X710 Dual Port 10GB PCI Card.
<br>
<br>
It is Running Red Hat 6.8 kernel 3.8.13-118.8.1.el6uek.x86_64, Suricata 3.0<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">NIC driver: i40e, version: 2.2.4 Latest firmware.<o:p></o:p></p>
<p class="MsoNormal"><br>
When the system boots the NIC cards will only observe broadcast traffic. In order for the card to receive all traffic being forwarded to it I have to do the following<br>
<br>
1. Stop em1, em2, p3p1,p3p2 (ifdown)<br>
2. modprobe –r i40e<o:p></o:p></p>
<p class="MsoNormal">3. modprobe i40e<o:p></o:p></p>
<p class="MsoNormal">4. Configure the interfaces<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">ethtool -K em1 tso off gro off ufo off lro off gso off rx off tx off rxvlan off txvlan off<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">ethtool -L em1 combined 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">ethtool -K em2 tso off gro off ufo off lro off gso off rx off tx off rxvlan off txvlan off<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">ethtool -L em2 combined 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">ethtool -K p3p1 tso off gro off ufo off lro off gso off rx off tx off rxvlan off txvlan off<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">ethtool -L p3p1 combined 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">ethtool -K p3p2 tso off gro off ufo off lro off gso off rx off tx off rxvlan off txvlan off<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">ethtool -L p3p2 combined 1<o:p></o:p></p>
<p class="MsoNormal">5. Bring the interfaces up (ifup)<br>
6. Start Suricata<br>
<br>
We have 100+ sensors with Intel cards in them with no issues. <br>
<br>
Has anyone experienced this issue and is there a fix????<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender
immediately and permanently delete the message and any attachments.
<br /><br />. . . . .</body></html>