[Snort-users] Promiscuouls Mode Question
jkipp5 at ...530...
Sun Sep 2 09:39:04 EDT 2001
> Seriously, look at the traffic. Is it only traffic bound for your IP? If so,
> you're seeing what you should be when not in promisc mode. If that's the
> case, then yes, it's all working as it should.
that seems OK.
> Try doing a 'tcpdump not host <foo>' with <foo> being your host. If you see
> traffic to/from other boxes other than ARP, then there is something kinda odd
> going on.
I tried this and I saw alot of arp request traffice from all sorts of
hosts not on my network. I did this with no activity on my LAN.
> Hope this helps!
Yes, it does. Thanks
More information about the Snort-users