[Snort-users] Configuration issue, Part II

Erek Adams erek at ...577...
Mon Sep 24 07:31:05 EDT 2001


On Mon, 24 Sep 2001, John Sage wrote:

> Let's see...
>
> *rummages around in logs*

[...snip...]

> <same sorta crap goes on for hours...>
>
>
> Realize, again, that this is snort and ipchains running on the same box.

I think that's the key thing here...  If it's on the same box, it should be
seen by snort, whereas if it's behind the firewall, it won't.

> Dialup, ppp...
>
> Command line:
>
> snortREL -b -i ppp0 -c /usr/local/snort-1.8.1-RELEASE/snortREL.conf &

*Gack*  Now that I really think about it, I do recall Marty or Dragos going
into a lengthy discussion on this.  Same box, OK.  Seperate and behind, bad.

I'm such a gimp.  Thanks for the correction John!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list