[Snort-users] Promiscuouls Mode Question

Jim Kipp jkipp5 at ...530...
Mon Sep 3 05:13:02 EDT 2001


Fyodor wrote:
> 
> On Sun, Sep 02, 2001 at 12:12:49PM -0400, Jim Kipp wrote:
> > If I run snort or tcpdump(on eth0), then do ifconfig -a eth0, it does
> > not report PROMISC. Only when I manually set promisc does it report it.
> > But tcpdump seems to be sniffing everything.  Is this normal?
> 
> Are you sure noone replaced your ifconfig with something funky? ;p

According to tripwire..no! also I just reinstalled it from the CD. 
SO I think it is the real thing. 

Thanks




More information about the Snort-users mailing list