[Snort-users] snort ignores ppp0

centipede centiped at ...1832...
Sun Apr 15 09:01:32 EDT 2001


Hi.

I've just initially installed snort.  the problem is that it detects 
intrusions only on my eth0
while utterly ignoring ppp0, which is, naturally, the only interface I 
really care to have a
NIDS on.
I tried switching between "-i eth0" and "-i ppp0" and between HOME_NET 
192.168.1.0/24
to HOME_NET $ppp0_ADDRESS but snort insisted on letting every ppp0 
packet slip
in innoticed.
I even tried using the "-i any" but it didn't work.  ipchains was of 
course suspended during
the tests and EXTERNAL_NET was set to "any" all the time.

any suggestions ?

thanks.





More information about the Snort-users mailing list