000034555 - Cannot initialize 10G interface for an RSA NetWitness Suite Packet Decoder

Document created by RSA Customer Support Employee on Dec 29, 2016Last modified by RSA Customer Support Employee on Apr 28, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000034555
Applies ToRSA Product Set: Security Analytics, NetWitness Logs and Packets
RSA Product/Service Type: Packet Decoder (Series 4S, Series 5)
RSA Version/Condition: 10.3, 10.4, 10.5, 10.6
Platform: CentOS
IssueAfter adding a 10G capture card and properly setting the configuration the interfaces do not come up. 
The following three steps can be performed to confirm the issue:
1. If the interface is toggled up and down, as in the following example, the interface is not initialized:
[root@packetdecoder]# ifdown p2p1
[root@packetdecoder]# ifup p2p1
Device p2p1 does not seem to be present, delaying initialization.

2. In /var/log/messages the following error will be found:
[root@packetdecoder]# cat /var/log/messages | grep "invalid for parameter"
Nov 1 16:47:11 packetdecoder kernel: ixgbe: `' invalid for parameter `RSS'

3. The content of zc-ixgbe.conf will have settings with no values assigned:
[root@packetdecoder]# cat /etc/pf_ring/zc-ixgbe.conf
RSS= LRO= numa_cpu_affinity=

CauseThis condition is caused by the 10G capture card being added to the packet decoder after the pfring driver is installed.
ResolutionPerform the following steps to correct the issue.

1. Find the version of the installed pfring driver:
# rpm -qa | pfring

2. Uninstall the pfring driver ( you'll need to substitute the version from the command run in step 1 ):
# yum remove pfring-6.0.3-8598.

3. Remove the /etc/pf_ring directory (if it still exists)
# rm -fr /etc/pf_ring

4. Reboot decoder:
# shutdown -r now

5. Reinstall the pfring driver ( you'll need to substitute the version from the command run in step 1 ):
yum install pfring-6.0.3-8598.

6. Reboot
# shutdown -r now

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.