[Snort-users] Running Snort Without an IP
jed at ...153...
Fri Aug 11 16:29:23 EDT 2000
> I have been using snort for almost a year, and have switched snort from my
> gateway to a standalone machine within my firewall. I was wondering how I
> would start snort without an IP address and to read from the rules text file.
Your interface does not require an IP address. In fact, I don't have
an IP address configured how I have things set up with the snort box
at CERT. All you have to do is make sure your interface is in
promiscuous mode. You would probably want to explicitly identify on the
command line the interface you want to sniff.
ie. ./snort -c /etc/snort.conf -i eth1
More information about the Snort-users