[Snort-users] running Snort on W2000:"interface \Device\Packet_NdisWanIp" problem

Michael Steele michaels at ...155...
Fri Nov 16 08:49:08 EST 2001

I guessing from your message that you would like to specify a certain
NIC to place your sensor on. You can use the –W switch to list your
installed interfaces and the –I switch to tell Snort which interface to
read from.

Commercial Snort Support <<->> 1.866.41.SNORT
  Silicon Defense - www.silicondefense.com
    Home of the new SENTRUS Snort sensor!
  Michael Steele - Snort Support Technician
-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Matija
Sent: Friday, November 16, 2001 8:06 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] running Snort on W2000:"interface
\Device\Packet_NdisWanIp" problem


I cannot get started with Snort!  I am on a Windows2000.
There are no messages from the beast:

C:\Program Files\Sourcefire\Snort-1.8.2>snort -v
Log directory = log
        --== Initializing Snort ==--
Initializing Network Interface \
Checking PID path...
PID stat checked out ok, PID set to C:\Program
Writing PID file to "C:\Program Files\Sourcefire\Snort-1.8.2"  
Decoding Ethernet on interface \Device\Packet_NdisWanIp     
and then nothing!

I wonder where is this interface information coming from: " interface
\Device\Packet_NdisWanIp " ?
I am at the same time running successfuly Ethereal from the same box --
however I
have the choice of 2 interfaces there:
-- if I choose \Device\Packet_NdisWanIp     I get nothing, as with snort
-- if I choose \Device\Packet_{452B97B2-...} Ethereal runs OK.

Is there any way of configuring this? I don't see anything in

 M. Matija Exel
 E.N.S.I.E.G., Service  Réseau / Lab. Automatique de Grenoble
 BP.  46 Cedex,  38402 St.Martin d'Heres,  FRANCE
 Tel : (+33) 4 76 82 71 12          Fax:(+33) 4 76 82 63 88
 Matija.Exel at ...4104...,  Matija.Exel at ...4103...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20011116/57d1a987/attachment.html>

More information about the Snort-users mailing list