[Snort-users] OT: promiscuous mode problems

Detmar Liesen counter.spy at ...348...
Fri Jul 19 03:43:04 EDT 2002


Hi,
maybe someone will be able to help me with a problem:

I am trying to merge two network interfaces (eth1 and eth2) of a compaq
netelligent dual nic (using the tlan driver) for sniffing both up- and downstream
off a shomiti network tap.

This can be done via the bonding and ifenslave linux features.

The bonding works okay, but I have encountered problems firing up the two
interfaces in promiscuous mode.

ifconfig eth1 up promisc
ifconfig eth2 up promisc

When I do this and try sniffing with tcpdump first on eth1, then on eth2, I
don't see any packets.

Funny thing is, when I once start iptraf with "force promiscuous" then I see
packets floating over the screen. After having done this, I can see the
packets in tcpdump as well.

Seems to me that there is some prob with the ifconfig command.

I am using SuSE 8.0.

Any ideas and suggestions will be greatly appreciated.

TIA,
Detmar

-- 
GMX - Die Kommunikationsplattform im Internet.
http://www.gmx.net





More information about the Snort-users mailing list