[Snort-users] Promiscuouls Mode Question

Jim Kipp jkipp5 at ...530...
Sun Sep 2 09:39:04 EDT 2001

> Seriously, look at the traffic.  Is it only traffic bound for your IP?  If so,
> you're seeing what you should be when not in promisc mode.  If that's the
> case, then yes, it's all working as it should.

that seems OK.

> Try doing a 'tcpdump not host <foo>' with <foo> being your host.  If you see
> traffic to/from other boxes other than ARP, then there is something kinda odd
> going on.

I tried this and I saw alot of arp request traffice from all sorts of
hosts not on my network. I did this with no activity on my LAN. 

> Hope this helps!

Yes, it does. Thanks

More information about the Snort-users mailing list