[Snort-users] IP needed

Brian Caswell bmc at ...312...
Wed May 16 09:28:28 EDT 2001


Olav Langeland wrote:
> 
> Trying to get snort to log on 2 NIC that have no IP set,
> they are passive monitoring on a switch. The host runs
> FreeBSD 4.3 and Snort v1.7.
> 
> I get the error below when I fire up snort, why?
> Used ifconfig to set MTU manually to 1500, no change.
> Promiscuous mode doesnt need IP on a NIC, does snort require it?
> 
> host# ./bin/snort -A fast -c conf/snort.conf -i fxp1,fxp2 -l logs/ -I
> 
>         --== Initializing Snort ==--
> 
> Initializing Network Interface fxp1,fxp2
> ioctl(SIOCGIFMTU): Device not configured
> ERROR: Can not get MTU of an interface fxp1,fxp2!

Thats because the interface "fpx1,fpx2" does not exist.  Run two
instances of snort, one on each interface.

-brian




More information about the Snort-users mailing list