Endace starts but the link is unstable/intermittent

book

Article ID: 159545

calendar_today

Updated On:

Products

Data Loss Prevention Network Monitor

Issue/Introduction

You configure Symantec DLP to use an installed Endace card, but when you run a 'dagconfig -si' the Link connection is not stable, and goes up and down (switches back and forth between 1 and 0). In some cases, the link may be stable, but the packet capture component starts and stops intermittently and will not stay running.

Resolution

One possible cause for this is a failed upgrade of the Endace drivers that DLP uses. To resolve this, you can remove the drivers and executables for Endace from the DLP install and replace them with the current Endace drivers.

Step 1: Verify the version of Endace drivers:

  • Open Device Manager (Right-click My Computer > Manage > Device Manager)
  • Double-click the Endace card to open the Properties window
  • Click the 'Drivers' tab and make a note of the 'Driver Version'

Step 2: Verify the location of the Endace driver files:

  • Locate the Endace drivers for your version of Endace.
  • The default location for these is in C:\Program Files\Endace\
  • Select the folder that matches the Driver Version from the previous step
  • Verify there is a \bin folder inside

Step 3: Remove the DLP copy of the Endace drivers

  • Stop the Symantec DLP services (Start > Run > 'services.msc' > Select each 'Vontu...' service and click 'Stop')
  • Move the Endace files
    • Browse to C:\Vontu\Protect\Bin or C:\SymantecDLP\Protect\Bin
    • Create a folder called 'backup'
    • Move the following files out of 'bin' and into the 'backup' folder
      • Any files starting with 'dag*'
      • Any other files whose names match those in the C:\Program Files\Endace\dag-*\bin folder
  • Restart Vontu services
  • Test link stability by running 'dagconfig -si' from a command prompt (in the C:\Program Files\Endace\dag-*\bin folder), and/or check the stability of the Packet Capture component.