[Snort-users] Promiscuous Mode

Bob Staaf rstaaf at ...1457...
Thu Mar 1 21:05:47 EST 2001


Hello all,

     Newbie here with a couple of questions.  I just installed Snort 1.7
from rpm on a Red Hat 6.2 box.  It has dual nics and I want to run snort on
eth1.  I installed libpcap via libpcap-0.4-19.i386.rpm from Red Hat.  I went
into /etc/rc.d/init.d/snortd and changed the Interface to eth1 and went into
/etc/snort/snort.conf and changed the IP address to reflect the address on
eth1.  When I start snort it still tries to initialize eth0.  I can force it
with -i but, it won't go into promiscuous mode.

Any ideas?

Thanks

Bob Staaf
Southern Web Services
Orlando, Fl





More information about the Snort-users mailing list