Dual Network Cards

RIB-EYE · 10-31-2005, 11:07 AM

Hello all, (No more stupid questions!!)

I am running Slackware 10.2 and have 2 network cards. The first card is plugged into my network and recieves an IP fine. I would like to connect the secound card to a Cisco switch that is configured for port forwarding. Basically I want to run Snort and monitor all traffic in andout of my network. The problem is that when I plug in the cable to that port on the switch, nothing shows up. How do I config that nic to allow it to see the packets that are coming into it?

Thanks in advance.

dd12 · 11-01-2005, 03:05 PM

Is the interface configured? What does 'ifconfig -a' show?

What does 'netstat -rn' show (routing table)

So many more questions but these are the basic questions.

bulliver · 11-01-2005, 03:17 PM

Yeah, to expand on dd12's response, the kernel only autodetects 1 NIC card. You need to modprobe the right module (if different) then ifconfig it up manually.

RIB-EYE · 11-01-2005, 04:27 PM

Sorry guys........little in-experienced here...

All I had to do was 'ifconfig eth1 up'
and life is good.

bulliver · 11-01-2005, 04:42 PM

Quote:

All I had to do was 'ifconfig eth1 up'
and life is good.

Good stuff. The thing is, this will only work until your next reboot. To make the changes permanent you need to do a little more work still:

You need to tell the kernel to initialize both NICS. I will give you an example from my system. First you need the hardware address of your 2 NICS, so run the following command:

Code:

#  lspci -v | grep -A6 "Ethernet controller"

Sample output from my system:

Code:

0000:01:06.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10)
        Subsystem: Realtek Semiconductor Co., Ltd. RT8139
        Flags: bus master, medium devsel, latency 32, IRQ 10
        I/O ports at d000 [size=256]
        Memory at ee000000 (32-bit, non-prefetchable) [size=256]
        Capabilities: [50] Power Management version 2

0000:01:08.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10)
        Subsystem: Realtek Semiconductor Co., Ltd. RT8139
        Flags: bus master, medium devsel, latency 32, IRQ 11
        I/O ports at d100 [size=256]
        Memory at ee001000 (32-bit, non-prefetchable) [size=256]
        Capabilities: [50] Power Management version 2

What you want is the IRQ and I/O ports address. Now we tell the kernel. I don't know if you use grub or lilo, but you must edit the arguments passed to the kernel (ie: the "kernel" line in grub.conf...) like this example:

Code:

ether=10,0xd000,eth0 ether=11,0xd100,eth1

the argument takes the form of:

Code:

ether={IRQ},{I/O address},{interface name}

and must be repeated for each interface. The interface name is up to you, you can set each NIC as eth0 or eth1 as you wish. Don't forget to add the "0x" in front of the I/O address.

If you need more help just ask....

Rex01 · 11-01-2005, 05:57 PM

Interesting info, bulliver.

Does anyone happen to know how it is that live CD distros like Knoppix manage to find both NICs and configure them? I've noticed that Knoppix (and derivatives like featherLinux) built on Linux 2.4 don't do this and Knoppix 4.0.2, which is built on Linux 2.6.12 does. The point where the eth0 and eth1 messages are printed is certainly long after lilo has run.

Thanks

bulliver · 11-01-2005, 06:16 PM

Quote:

Does anyone happen to know how it is that live CD distros like Knoppix manage to find both NICs and configure them?

I can only assume that there is some code in the /linuxrc script (part of an initrd) that checks for additional NICs and sets them up automatically.

Quote:

The point where the eth0 and eth1 messages are printed is certainly long after lilo has run.

Well, lilo has nothing to do with the discovery of the NICs, lilo.conf and grub.conf are just an easy way to pass arguments to the kernel (the 'kernel command line') which is the real goal.

dd12 · 11-02-2005, 06:25 AM

Different distributions have different startup scripts....you are correct. Under RHEL /etc/sysconfig/network-scripts has most of what you need. If above all you needed to do was an ifconfig then you already had the hardware detected. All you need to find is the proper place to configure on reboot for Slakware.

Rex01 · 11-03-2005, 05:00 PM

Okay, I'll take a stab at it, then - is it done in hwsetup?

That's Knopper's program for finding hardware; it usually runs from a script like /etc/rcS.d/knoppix-autoconfig. Is that where the NICs are discovered? If so, has Knopper changed hwsetup for Linux 2.6 so that it does a more thorough job or is it just naturally benefiting from some improvements made in 2.6? Should this move to the Knoppix forum :-) ?

Thanks

oops, looks like my problem was the older distros didn't have support for the 3com 3c940 on this mobo - Linux 2.4 version of DSL is definitely finding two NICs just fine. Sorry for the noise.