[Snort-users] strange promiscuous behaviour.
bhenry at ...826...
Thu Oct 25 20:42:07 EDT 2001
I recently installed snort (again), and had it working initially, but then
it stopped for no apparent reason.
even snort -dvi eth0 only gave back minimal traffic, arp's and other
in /var/log/messages each time I started snort it "left promiscuous mode",
and each time stopped snort it "entered promiscuous mode", as opposed to
the other way around.
I read in the archives about libpcap not checking promisc mode, and just
toggling it. So I cycled the machine so it started back in the correct
mode, then snort worked properly.
It didn't matter if snort was in daemon mode or not. I'm not sure how the
problem started, but I'll keep an eye on it, just thought I'd mention my
** Brock Henry - brockh at ...827... (H) - bhenry at ...826... (W) **
** Adventure? Excitement? A Jedi craves not these things.**
More information about the Snort-users