[Snort-users] Configuration issue, Part II

Erek Adams erek at ...577...
Mon Sep 24 07:31:05 EDT 2001

On Mon, 24 Sep 2001, John Sage wrote:

> Let's see...
> *rummages around in logs*


> <same sorta crap goes on for hours...>
> Realize, again, that this is snort and ipchains running on the same box.

I think that's the key thing here...  If it's on the same box, it should be
seen by snort, whereas if it's behind the firewall, it won't.

> Dialup, ppp...
> Command line:
> snortREL -b -i ppp0 -c /usr/local/snort-1.8.1-RELEASE/snortREL.conf &

*Gack*  Now that I really think about it, I do recall Marty or Dragos going
into a lengthy discussion on this.  Same box, OK.  Seperate and behind, bad.

I'm such a gimp.  Thanks for the correction John!

Erek Adams

More information about the Snort-users mailing list