From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1GivhU-00031h-Bx for garchives@archives.gentoo.org; Sat, 11 Nov 2006 16:27:24 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.13.8/8.13.8) with SMTP id kABGP9At015703; Sat, 11 Nov 2006 16:25:09 GMT Received: from gabriel.sub.uni-goettingen.de (gabriel.sub.uni-goettingen.de [134.76.163.126]) by robin.gentoo.org (8.13.8/8.13.8) with ESMTP id kABGN193015360 for ; Sat, 11 Nov 2006 16:23:01 GMT Received: by gabriel.sub.uni-goettingen.de (Postfix, from userid 8) id 045ED107C31; Sat, 11 Nov 2006 17:22:56 +0100 (CET) Received: from localhost (dslb-082-083-033-186.pools.arcor-ip.net [82.83.33.186]) by gabriel.sub.uni-goettingen.de (Postfix) with ESMTP id 1D3CA107C25 for ; Sat, 11 Nov 2006 17:22:52 +0100 (CET) Date: Sat, 11 Nov 2006 17:26:42 +0100 From: Hans-Werner Hilse To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] My Snort server -- I Don't know whats wrong -- It seems to go to sleep Message-Id: <20061111172642.37c9c813.hilse@web.de> In-Reply-To: <17CD9CE4C0FA574A8B29EF02D49B385D2A95AB@srvexch-01.mcaschool.local> References: <17CD9CE4C0FA574A8B29EF02D49B385D2A95AB@srvexch-01.mcaschool.local> X-Mailer: Sylpheed version 2.2.9 (GTK+ 2.10.6; i586-pc-linux-gnu) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@gentoo.org Reply-to: gentoo-user@lists.gentoo.org Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Details: No, hits=1.7 required=5.0 tests=AWL,RCVD_IN_NJABL_DUL, RCVD_IN_SORBS_DUL autolearn=no version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on gabriel.sub.uni-goettingen.de X-Archives-Salt: ac098586-70da-4c2e-83ca-157ab49ff92e X-Archives-Hash: ec0eaecec12d29631672c9b5024c351b Hi, On Fri, 10 Nov 2006 17:32:10 -0500 "Timothy A. Holmes" wrote: > The short summary is the box > keeps "going to sleep" on me. It wont respond to ssh or webpage > requests till I ping it about 10 times after that it works normally. First: I assume you've checked all cables and tried to exchange them against some that are known working? Maybe even tried another port on the switch for the administrative interface? Then it sounds like an ARP problem to me. I'd start with running tcpdump on the administrative interface in order to see what that machine's seeing, and when. My blind guess would be that something irritates the routing, hence my guess that ARP's a bit broken. The routing table entry would time out and the machine you're using to connect to the admin interface needs some time to get a proper ARP answer. Is that snort machine's kernel somehow patched w/ regard to ARP/Routing? Did you configure ARP via sysctl to non-default values? You can check that suggestion by setting a routing table entry for the target machine manually on your SSH client machine ("arp -s"). -hwh -- gentoo-user@gentoo.org mailing list