Why am you not seeing traffic on DLPI Type 2 interfaces?
This issue is specific to RealSecure Server Sensor SR 4.3 on Solaris 10. A patch and repackage are available to address this issue. With the patch, the method for pushing our packet capture device (PCD) has changed from pushing and plumbing the interface, to pushing PCD before the interface is brought up. It allows for the correct binding of PCD through the use of "autopush".
Please contact Technical Support using the link below to request the patch and reference patch 773.
If the above information does not resolve your issue, please contact IBM Security Systems Technical Support.
RealSecure Server Sensor