[Snort-users] help please

Erek Adams erek at ...577...
Thu Sep 27 08:08:09 EDT 2001

On Thu, 27 Sep 2001, d'Ambly, Jeff wrote:

> Ok sweet, that worked but now I can't use eth1
> Snort received signal 2, exiting
> [root at ...2306... conf]# snort -o -c -i eth1 ./snort.conf

Easily fixed.  :)

Start it with:  snort -o -i eth1 -c ./snort.conf

It's seeing the -c and expecting to find the next parameter as a config file.
It sees "-i eth1 ./snort.conf" as the parameter. :)  Actually, you don't even
need the -c ./snort.conf, as snort will default to looking for ./snort.conf
and /etc/snort.conf when it starts.

> This is a 100mb interface that does not have an ip address, I want to do
> this because I have setup a spanning session on the switch, to mirror all
> traffic on vlan across this one port. Think of it like a hub, in a way.

Yeppers.  That will work just fine.

Glad to get ya up and running!

Erek Adams

More information about the Snort-users mailing list