DSS Expert Not Loaded?

[Gronkman]

Hi - we have several licensed DSS appliances (Ver 4.30.012). Three (3) of them now do not load Expert when I run them from Console. The Dashboad dials have no "hands", the date shows "NaN" and time shows "NaN:NaN:NaN". When I try to run a capture trace, I receive this pop-up msg: "Expert could not loaded [sic] on the Agent. Capture will continue without expert. Please re-install the Agent"
When I OK this, I get another popup msg: "Failed to start capture! Please lower capture buffer size and try again.". The buffer options in Define Capture Filter are 8 MB and 256 KB, rather than the 256KB - 256 MB buffer options with the working DSSs. I have also re-imaged 1 of these "faulty" DSSs and NAI has sent me a new "Options file" - to no avail. Has anyone seen this before ?

Thanx.

R.B. Stewart

 

[phaelon56]

I have not seen it before but have the impression that v4.2 r3 and v4.35 are both more stable than v4.3

Have you tried upgrading a working box to v4.35 or asking them for a v4.35 image? It might be worth a try.

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[Gronkman]

Thanx for the reply, Owen ... I guess I will upgrade to the
new version. In the interim, I think I will use another Sniffer to capture traffic to my Console from the remote Sniffers. I re-imaged a DSS and sent it to Montreal; my console worked perfectly with this DSS (locally) and now the same thing occurs remotely ... possibly our Secure Perimeter is screening certain packets.

Interesting ... will let you know ...

Thanx again, Owen.

R.B. Stewart

 

[phaelon56]

The newest Sniffer builds (including images that you get from NetGen) have a variety of things done to the BIOS and the OS that are intended to increase efficiency and harden for security reasons. It may be one of these that's causing the issue? Also check to see if your perimeter security has any port blocking or other restrictions that may affect DCOM communication - Sniffer uses a proprietary or modified flavor of DCOM to communicate between Console and Agent.

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[Gronkman]

Thanx again, Owen ... I just received the DSS with which I had the original symptoms (no "hands" on Dashboard dials, etc.) and it runs find in my office on local Network. I shall persevere and determine what frames are being blocked,
etc.

Reagards.

R.B. Stewart

 

[phaelon56]

Sounds like you may need a Sniffer to fix your Sniffer problem!!! {;-)

Perhaps you could put a tap or small shared media hub in the link that connects transport card of the Agent box to the network and connect a portable Sniffer (or any PC running Ethereal)). Do the same thing at the console end and try to sychronize a short capture on each. I can't remember what port the Agent and Console communicate on but I do recall that some security folks have on occasion closed that port or ports down when some worm/virus outbreaks occurred and it interfered with the Console communication.

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com