[Snort-users] Snort and interface parameter

Alexander Hoogerhuis alexh at ...3932...
Sun Feb 10 16:36:04 EST 2002


I have snort running on my clunky laptop (running Linux 2.4), which
has various interface going up and down depending on what I am doing
(irda, two ethernet and sometimes VMware). If snort is started without
a specific interface in non-promiscous mode, will it then listen to
all available packets passing through the machine or do I have to
explicity specify what interfaces I want it to sniff on?

The idea is to have a statement in /etc/modules.conf that will do a
kill -SIG to snort every time an interface module is loaded to amke
sure it covers all interfaces...

ttfn,
A
-- 
Alexander Hoogerhuis                               | alexh at ...3932...
CCNP - CCDP - MCNE - CCSE                          | +47 905 76 198
"You have zero privacy anyway. Get over it."  --Scott McNealy




More information about the Snort-users mailing list