[Snort-users] strange promiscuous behaviour.

Brock Henry bhenry at ...826...
Thu Oct 25 20:42:07 EDT 2001


Hi :)

I recently installed snort (again), and had it working initially, but then 
it stopped for no apparent reason.

even snort -dvi eth0 only gave back minimal traffic, arp's and other 
broadcasted(?) traffic.

in /var/log/messages each time I started snort it "left promiscuous mode", 
and each time stopped snort it "entered promiscuous mode", as opposed to 
the other way around.

I read in the archives about libpcap not checking promisc mode, and just 
toggling it. So I cycled the machine so it started back in the correct 
mode, then snort worked properly.

It didn't matter if snort was in daemon mode or not. I'm not sure how the 
problem started, but I'll keep an eye on it, just thought I'd mention my 
experiences.

Brock Henry

** Brock Henry - brockh at ...827... (H) - bhenry at ...826... (W) **
** Adventure? Excitement? A Jedi craves not these things.**





More information about the Snort-users mailing list