[Snort-users] Assign NO ip addr to interface

Paul Murphy paul.murphy at ...2217...
Thu Jun 14 10:48:45 EDT 2001


Is your snorting machine protected in anyway from the outside?  If not, then take the IP address off.  Do you need it for anything, seeing as snort doesn't?

>>> "Sheahan, Paul (PCLN-NW)" <Paul.Sheahan at ...2218...> 6/14/2001 03:33:14 pm >>>
My question, SHOULD I assign an IP address to the "Snorting" card or not?
Right now I have an IP address assigned to it. Coincidentally, I am having
network/communication problems with the box and not sure if this would
effect things. Should I leave the IP address on the SNORT interface or take
it off?

Thanks,

Paul Sheahan
Manager of Information Security
Priceline.com
paul.sheahan at ...2218... 



-----Original Message-----
From: Peter Bates [mailto:Peter.Bates at ...79...] 
Sent: Thursday, June 14, 2001 9:54 AM
To: snort-users
Subject: Re: [Snort-users] Assign NO ip addr to interface



Hello there...

All I have (personally) is a line in /etc/rc.d/rc.local that says:

/sbin/ifconfig eth1 up promisc

considering eth1 as the 'snorting' card.

When you then examine the interface using ifconfig,
you will not the usual flags associated with it (UP BROADCAST, etc.)
but notice it hasn't got an IP address defined...

You can probably do the same using something in 
/etc/sysconfig/network-scripts/ifcfg-eth1 like:

DEVICE=eth1
ONBOOT=yes

But I've never tried it that way myself...

This is listed in the FAQ, I believe:

http://www.snort.org/FAQ.html 




----------------------------------------------------------------------------
---------------------------------------->
Peter Bates, Systems Support Officer, Network Support Team.
London School of Hygiene & Tropical Medicine.
Telephone:0207-927 2124 / Fax: 0207-436 5389 / Pager: 07625 255362


_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net 
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users 
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users 

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net 
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users 
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



---------------------------------------------------------------------------------------------------------------------------
CRESTCo Ltd.             The views expressed above are not necessarily those
33 Cannon Street.        held by CRESTCo Limited.
London  EC4M 5SB (UK)      
+44 (020) 7849 0000     http://www.crestco.co.uk 
---------------------------------------------------------------------------------------------------------------------------




More information about the Snort-users mailing list