[Snort-users] running snort questions

Daniel Lopez dlopez at ...6134...
Wed Jul 24 12:34:13 EDT 2002


> you can still use the interfaces file:
> [root at ...6425...:/etc/network]# cat interfaces
> <snip>
> iface eth2 inet static
> <snip>
> works for me:
> [root at ...6425...:/etc/network]# ifconfig
> eth0      Link encap:Ethernet  HWaddr 00:80:C8:B9:F9:C9
>            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>            RX packets:450630038 errors:9 dropped:0 overruns:0 frame:15
>            TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
>            collisions:0 txqueuelen:100
>            RX bytes:209873534 (200.1 MiB)  TX bytes:0 (0.0 b)
>            Interrupt:10 Base address:0xa800

I have the same on my /etc/network/interfaces file:

iface eth0 inet static

and when I do a "ifconfig", I can see that my eth0 interface is not up!
Only the lo interface is up. To be able to see the eth0 interface up, I
have to put the options
address and netmask after "iface eth0 inet static"
Any idea?

> the only thing that doesn't work for me on this machine is
> snort -i any.
> that only puts eth0 in promiscuous mode (using snort-mysql
> Version 1.8.7
> (Build 128)).

I launched snort with the -i option and it doesn't put my NIC in
promiscuous mode.
I have to do it manually.
Does Snort set your NIC in promiscuous mode when you run it??

Thanks for any advice and help!


More information about the Snort-users mailing list