[Snort-users] spp_defrag.c beta 14

Dragos Ruiu dr at ...50...
Tue Jul 25 22:35:23 EDT 2000


On Tue, 25 Jul 2000, you wrote:
>   BTW, it seems the snort doesn't work for the interface "lo".  I have to use
> the interface eth0  in order to see the alert (which means I have to run the
> simulation testing from two physically separate machines). Hopefully I am not
> missing something here.

Odd, on rh62 "snort -a -v -i lo" seems to work fine.
Which pcap are you using and what complaint do you get.?

cheers,
--dr

-- 
dursec.com ltd. / kyx.net - we're from the future    http://www.dursec.com




More information about the Snort-users mailing list