Why does the sensing interface flap or frequently go to the down state in IDS ?

Hi all,
this is the answer I found in Cisco website, but according to this, I didnot make any updates or any configuration changes, but stilll my sensing interface is going down. I'm not even getting the error messages which they have mentioned at the end.
Ans: During a signature update and reconfigurations, sensorApp stops to process packets as it processes the new signatures in the update. The network driver detects that sensorApp has stopped and pulls any new packets from the buffer. So the network driver does different things, which depends on the configuration and sensor model:
Promiscuous Interface—It brings the link down on the interfaces, and brings the link back up once sensorApp starts to monitor again.
Inline Interface or Inline Vlan Pair—It depends on the Bypass setting:
Bypass Auto—The driver keeps the link up and begins to pass packets through without analysis. It then reverts back to sending the packets through sensorApp once sensorApp starts to monitor again.
Bypass Off—The driver brings the link down on the interfaces, which is the same as in promiscuous mode, and brings them back up once sensorApp starts to monitor again.
So, if sensor app does not pull packets from the buffer, which possibly occurs because there is no interface configured to process packets, then the driver can put the interface in a down state.
These logs are seen when the sensing interface flaps:
28Jun2011 09:03:09.483 6050.885 interface[409] Cid/W errWarning Inline databypass has started. 28Jun2011 09:03:13.639 4.156 interface[409] Cid/W errWarning Inline databypass has stopped. 28Jun2011 09:19:23.922 970.283 interface[409] Cid/W errWarning Inline databypass has started. 28Jun2011 09:19:27.486 3.564 interface[409] Cid/W errWarning Inline databypass has stopped.

It is possible you are overloading that little 4215. If that is the case you should also be seeing "missed packet percentage" messages in your events.
How much traffic is your 4215 getting? Those sensors will start to drop packets for inspection at about 30 Mb/s.
- Bob

Similar Messages

  • Why does my Apple TV have to frequently reactivate some channels

    Why does my Apple TV have to frequently reactivate some channels, such as HBO Go and PBS and several others that I know were already activated.

    Maybe a software update reset something, maybe the broadcasters require this at intervals, could someone have logged/signed out?  Sorry don't get those channels in UK, but once Netflix made me log in again, others seem ok.
    You could send some feedback if this happens very often:
    Apple - Apple TV - Feedback

  • I have Elements 11. Sometimes, if I edit a photo in Elements Editor, the date gets changed to the current date. Why does that happen? It doesn't happen all the time, so I can't isolate the cause. Any ideas?

    I have Elements 11. Sometimes, if I edit a photo in Elements Editor, the date gets changed to the current date. Why does that happen? It doesn't happen all the time, so I can't isolate the cause. Any ideas?

    I have Elements 11. Sometimes, if I edit a photo in Elements Editor, the date gets changed to the current date. Why does that happen? It doesn't happen all the time, so I can't isolate the cause. Any ideas?

  • Why does FireFox open as a very small box in the top l/h corner and i have to resize it every time

    Why does FireFox open as a very small box in the top l/h corner and i have to resize it every time this only occurs on the initial opening up of F/Fx after boot-up

    Open the system menu via Alt+Space and see if you can resize that window.<br />
    If that works then close Firefox (File > Exit/Quit) to save that setting.
    See also:
    * http://kb.mozillazine.org/Resizing_oversize_window
    If the above didn't help then see:
    * http://kb.mozillazine.org/Corrupt_localstore.rdf

  • IF UPDATES TO APPS THAT CAME WITH OUR MAC ARE FREE, WHY DOES APPLE REQUIRE BILLING INFORMATION TO BE COMPLETED IN THE SCREEN JUST BEFORE ACCESS TO INSTALLING FREE UPDATES???

    IF UPDATES TO APPS THAT CAME WITH OUR MAC ARE FREE, WHY DOES APPLE REQUIRE BILLING INFORMATION TO BE COMPLETED IN THE SCREEN JUST BEFORE ACCESS TO INSTALLING FREE UPDATES???

    It is necessary to confirm your identity as the 'buyer'.  Please do not use all capital letters.  It is not well regarded here and can be tricky to read for some. Thank you.

  • Why does my screen come up dark when I press the camera icon?

    Why does my screen come up dark when I press the Camera icon?  I can neither take pictures nor look at the photos I have saved.

    Doulbe tab the home key to see the task bar.  Touch and hold any of those icons until they jiggle, then delete them by touching the minus sign.   Then reboot the pad by holding the sleep and home buttons until the apple logo appears.  Ignore the red slider.
    You either have another app open that is using the camera, or you just have too much stuff in memory.  The reset process should clear it up.

  • Why does my macbook pro retina display shutdown while entering the administer account

    why does my macbook pro retina display shutdown while entering the administer account

    Please read this whole message before doing anything.
    This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.
    The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, or by corruption of certain system caches. 
    Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards. Boot in safe mode and log in to the account with the problem. Note: If FileVault is enabled, or if a firmware password is set, or if the boot volume is a software RAID, you can’t do this. Ask for further instructions.
    Safe mode is much slower to boot and run than normal, and some things won’t work at all, including sound output and  Wi-Fi on certain iMacs. The next normal boot may also be somewhat slow.
    The login screen appears even if you usually log in automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin. Test while in safe mode. Same problem? After testing, reboot as usual (i.e., not in safe mode) and verify that you still have the problem. Post the results of the test.

  • TS1382 why does my ipod classic keep saying its charging and the back of it get hot

    why does my ipod classic keep saying its charging and the back of it gets hot

    The battery and/or charging circuit may be faulty. Reset the device and try again having let it cool down first.
    tt2

  • Want new tab to open to home page and why does firefox not have a simple check box in the options because I can't keep going through a long procedure each time

    I want new tab to open to home page and why does firefox not have a simple check box in the options because I can't keep going through the long tedious procedure each time I install firefox. It is something that should be in the options tab , and I want to know why it isn't. I am totally frustrated with firefox and getting ready to switch.

    You can use the SearchReset extension to reset some preferences to the default values.
    *https://addons.mozilla.org/firefox/addon/searchreset/
    Note that the SearchReset extension only runs once and then uninstalls automatically, so it won't show on the "Firefox > Add-ons" page (about:addons).
    If you do not keep changes after a restart or otherwise have problems with preferences, see:
    *http://kb.mozillazine.org/Preferences_not_saved

  • Why does a pop up screen ask me to extract the image using Lightroom Installer, when all I want to d

    Why does a pop up screen ask me to extract the image using Lightroom Installer, when all I want to do is view it ?

    My local computer shop solved the problem. Apparently when you download cloud it changes a lot of settings.
    So second issue.
    Why do I now get asked to burn to disc rather than saving to my hard drive when I want to export from Lightroom ?

  • Why does my itunes say "Itunes could not connect to the iphone because the device timed out"? I just want to sync my iphone with my itunes. please help

    why does my itunes say "Itunes could not connect to the iphone because the device timed out"? I just want to sync my iphone with my itunes. please help

    If you are using a USB hub, don't. Connect directly to the computer. Disconnect all other USB devices except for keyboard and mouse.

  • Why does Safari 5.1/Lion 5.7 always open the last Web sites  when you open Safari?

    Why does Safari 5.1/Lion 5.7 always open the last Web sites  when you open Safari?
    MacBook Pro 2.33 GHz intel core2 Duo

    Welcome to the iOS world of nonthinking, wherein the OS decides everything for you, whether or not that's what you want. Salient details described in http://www.apple.com/macosx/whats-new/features.html#resume
    See one of these to disable it:
    http://hints.macworld.com/article.php?story=20110918051930924
    http://osxdaily.com/2011/08/01/turn-off-resume-per-app-in-mac-os-x-lion/
    http://restoremenot.info/

  • Why does it take iMovie longer to import video than the length of the video? For example- it took 2 mins and 15 secs to import 2 mins and 4 secs of video...

    why does it take iMovie longer to import video than the length of the video? For example- it took 2 mins and 15 secs to import 2 mins and 4 secs of video...

    It's not like playing a tape. It has to convert it from whatever format you currently have into a codec suitable for editing (Apple Intermediate). This will take longer or shorter depending how compressed your original format is, and on the ability of your CPUs to catch up.
    Matt

  • HT5930 Why does my Aperture v3.5.i look different from the one shown in the online videos

    Why does my Aperture v3.5.i look different from the one shown in the online videos

    Are you asking about the colorful icons in the video?
    The video must have been done with an Aperture version 3.2.4 or earlier. Since Aperture 3.3 are the icons drab and gray - the Aperture 3.3 Release Notes are calling this:
    Newly designed monochrome source list and toolbar icons.
    The Release notes will tell you, what has changed since then:
    http://support.apple.com/kb/TS2518
    --Léonie

  • Why does my iphone loss WIFI connection when I leave the room? When other mobile devices stay connected?

    Why does my IPhone loss WIFI connection when I leave the room? When other mobile devices stay connected?
    I can not send text messages to other IPhones if I do not have wifi or 3G on, the texts are sent as emails.

    Hey Linders1987,
    Welcome to the Apple Support Communities! I understand that you are experiencing issues with Wi-Fi on your iPhone 5. The following resource may provide a solution:
    iOS: Troubleshooting Wi-Fi networks and connections - Apple Support
    http://support.apple.com/en-us/TS1398
    Wi-Fi disconnects or signal strength is less than expected
    Move closer to the Wi-Fi router (access point).
    Check for sources of potential interference.
    Remove any case, stand, or other accessories from your iOS device and see if signal strength improves.
    Reset network settings by tapping Settings > General > Reset > Reset Network Settings.
    Note: This will reset all network settings including
    - previously connected Wi-Fi networks and passwords
    - recently used Bluetooth accessories
    - VPN and APN settings
    Thanks,
    Matt M.

Maybe you are looking for