Can not find default adapter 1

[JJ1]

Hi All,

I have this very weird problem on one of our distributed sniffers (running agent version 410048).

When we try to connect to it from the Distributed Sniffer Pro Console, we recieve the error [red]"Can not find default adpater."[/red]

All the bindings on the sniffer are correct - the transport NIC has a TCP/IP binding and the monitor NIC's are bound to the sniffer driver only.

I can ping the machine and can remote desktop into it, so AFAIK, there are no issues with the transport NIC.

Any advice would be much appreciated.
Many thanks,

James.

 

[AlexTovar]

Hi James:

The problem could be resolved if you try to "modify" the agent you created in Sniffview console:

-Select the agent ( single click )
-Right click and select "Modify"
-Don't change the name, click "Next"
-Review IP address, then click "Get Card List"
-If appears, select the Adapter for that agent.
-click OK

If the adapter appears in the list, you're done, but if not, you should reinstall the adapter you need in the Remotre Agent.

It happens when the Name or Description of the adapter was changed on the agent, or if it was reinstalled.

Hope this helps

Alex

 

[JJ1]

Alex,

Thanks. You were right! I think some of the bindings on the monitor NIC's were dodgy, but even when I did fix them, the error message did not go away.

Modifying the sniffer agents listed by the console, as you suggested, did seem to resolve the issue.

One more question: I know that the monitor NIC's do not have IP addresses, but is there any way to find out which networks the NIC's are monitoring?

Thanks again,

James.

 

[AlexTovar]

James:

Hope I understood your question.
There are several ways you can find out which networks are being monitored:
Expert screen, at "subnet" level and objects, you can find subnets taking part of your segment.
Watching at matrix or Host table you can do it too.

Those are the easiest way to find what subnets are present, and don't forget about port mirror feature.

Hope this helps

Alex

 

[JJ1]

Thank you. That's the answer I was looking for!
Kind regards,

James.

 

[JJ1]

Reading your answer a second time, please could you tell me what the 'port mirror feature' is? I couldn't seem to find it anywhere in the Sniffer Pro help files.

 

[AlexTovar]

Hi James:

"Port Mirror" or "Spanning Port" is a feature of almost all the switch available ( Cisco, Nortel, 3Com, etc. ).

Sniffer monitors physical segments, every port in a switch is in reality a physical segment, so if you want to monitor the traffic of a group of ports, a module or the whole swicth, it has to send "a copy" of the traffic you want to see to the port sniffer is attached to, so it can monitor all the traffic. In a different way, if you don't program a spanning or mirroring port, you'd see traffic from any station to a broadcast address, and you won't get useful information at all.

See your switch documentation for more info; on the other hand, if you have only Hubs ( plain network ), you don't need Port mirror at all.

Hope this helps

Alex