[Snort-users] Changing ip

Martin Roesch roesch at ...421...
Wed Nov 8 17:44:36 EST 2000


Run Snort in sniffer mode (snort -dvi eth0) and make sure it can see the
packets.  Then run it with the HOME_NET set appropriately for the network
you're defending.

If it's all set right, once it's running do an "ifconfig -a" and make sure the
interface is in promiscuous mode (it'll say so in the options section of the
printout).  If it's not, there should be a way to set it manually.  Try that
and let us know how it goes.


     -Marty

Michael Tench wrote:
> 
> Greetings;
> 
> I have changed the IP address fo a Linux box running Snort. Since that time,
> Snort no longer works. Even if I specify the interface (eth0), it no longer
> works.
> 
> As a secondary question, do any of you know how I could actually
> remove the address from the interface, then have snort monitor it?
> 
> Do any of you have a suggestion?
> 
> Thank you for dealing with my very basic questions.
> Michael Tench
> 
> _______________________________________________________
> Say Bye to Slow Internet!
> http://www.home.com/xinbox/signup.html
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users

-- 
Martin Roesch
roesch at ...421...
http://www.snort.org



More information about the Snort-users mailing list