Argus with bonded interface

[Peter Van Epp]

On Mon, Sep 27, 2010 at 05:22:49PM -0400, Carter Bullard wrote:
> Well, you definitely aren't getting any packets here.  Increase the debug level to 10, and
> we'll see the result of the select() calls on the bond0 interface.
> 
> Also don't use the -F /etc/argus.conf.  That is causing you to read the conf twice.
> Instead, run it this way:
> 
>    /usr/local/sbin/argus -X -D10 -i bond0
> 
> The '-X' will nullify anything that was in the /etc/argus.conf file. 
> Very curious.
> 
> Carter
> 

	Trying 

tcpdump -i bond0

on the machine (if you haven't already) would also be a good bet to see if the
problem is before argus (which seems somewhat likely). If tcpdump shows no 
output there is a problem somwhere in pcap not argus. 

Peter Van Epp