[Snort-devel] check for promiscious mode needed ?
erek at ...835...
Wed Apr 23 09:10:46 EDT 2003
On Wed, 23 Apr 2003, Andreas Wurzinger wrote:
> last week I had the phenomenon that snort died and as I tried to restart
> him it always came up properly but didn't detect anything. After doing some
> diagnosis on snort I discovered that when snort was not running the nic was
> in promiscious mode and when snort came up the card switched over to
> "normal mode" leaving the promiscious state.
> Is it possible that there's a little check needed in snort to proove wether
> the promiscious mode on the sensor nic is already enabled or not ?
Lemmee guess, you're on Linux? Linux tends to implement the promisc
setting as a flag. Set it once, and it's on. Set it twice and it's off.
Set it three times and it's on.
Should Snort check? *shrug* That's a coder decsion. :)
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-devel