[Snort-users] Possible promiscuous mode problem

John Berkers berjo at ...827...
Fri Mar 9 04:59:17 EST 2001


 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Have you got your snort box plugged into a switch?  If that is the
case you might need to configure the switch (if possible) to forward
all traffic to the port the snort box is on.  That would explain why
snort is not picking up traffic directed at other hosts in the
subnet.  Also, are the Large UDP packets being received broadcasts? 
They would go to every port on the switch automatically.

Hope that helps you to resolve your problems.

John

- -----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Brian
Caswell
Sent: Friday, 9 March 2001 6:44
To: root
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Possible promiscuous mode problem


root wrote:
>         I recently installed a snort-1.7-1.i386.rpm on my dual
> processer DELL box running RedHat 6.2.  I'm missing some
> functionality.

There is your problem.  Redhat screwed up libpcap for 6.X.  Install a
newer version of libpcap, and then you should be good to go.

- -- 
Brian Caswell
The MITRE Corporation

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBOqipdQRiy4kmcIkhEQJ+zgCdF/TxKN0nAZzkzd+z3sH/ivGXt3wAn2xf
0xZRrZ9C805EhK6OntZ4HgaN
=3lCp
-----END PGP SIGNATURE-----





More information about the Snort-users mailing list