Cannot initialize 10G interface for an RSA NetWitness Suite Packet Decoder

Issue

After adding a 10G capture card and properly setting the configuration the interfaces do not come up.

The following three steps can be performed to confirm the issue:

1. If the interface is toggled up and down, as in the following example, the interface is not initialized:

 [root@packetdecoder]# ifdown p2p1
 
[root@packetdecoder]# ifup p2p1
 
Device p2p1 does not seem to be present, delaying initialization.

2. In /var/log/messages the following error will be found:

 [root@packetdecoder]# cat /var/log/messages | grep "invalid for parameter"
 
Nov 1 16:47:11 packetdecoder kernel: ixgbe: `' invalid for parameter `RSS'

3. The content of zc-ixgbe.conf will have settings with no values assigned:

 [root@packetdecoder]# cat /etc/pf_ring/zc-ixgbe.conf
 
RSS= LRO= numa_cpu_affinity=

Cause

This condition is caused by the 10G capture card being added to the packet decoder after the pfring driver is installed.

Resolution

Perform the following steps to correct the issue.

1. Find the version of the installed pfring driver:

 # rpm -qa | pfring

2. Uninstall the pfring driver ( you'll need to substitute the version from the command run in step 1 ):

 # yum remove pfring-6.0.3-8598.2.6.32.642.6.2.el6.x86_64

3. Remove the /etc/pf_ring directory (if it still exists)

 # rm -fr /etc/pf_ring

4. Reboot decoder:

 # shutdown -r now

5. Reinstall the pfring driver ( you'll need to substitute the version from the command run in step 1 ):

 yum install pfring-6.0.3-8598.2.6.32.642.6.2.el6.x86_64

6. Reboot

 # shutdown -r now

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.

Product Details

RSA Product Set: Security Analytics, NetWitness Logs and Packets
RSA Product/Service Type: Packet Decoder (Series 4S, Series 5)
RSA Version/Condition: 10.3, 10.4, 10.5, 10.6
Platform: CentOS

Summary

This article describes a workaround to correct a 10G config issue.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue