[Snort-users] running snort questions
dlopez at ...6134...
Wed Jul 24 12:34:13 EDT 2002
> you can still use the interfaces file:
> [root at ...6425...:/etc/network]# cat interfaces
> iface eth2 inet static
> works for me:
> [root at ...6425...:/etc/network]# ifconfig
> eth0 Link encap:Ethernet HWaddr 00:80:C8:B9:F9:C9
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:450630038 errors:9 dropped:0 overruns:0 frame:15
> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:100
> RX bytes:209873534 (200.1 MiB) TX bytes:0 (0.0 b)
> Interrupt:10 Base address:0xa800
I have the same on my /etc/network/interfaces file:
iface eth0 inet static
and when I do a "ifconfig", I can see that my eth0 interface is not up!
Only the lo interface is up. To be able to see the eth0 interface up, I
have to put the options
address and netmask after "iface eth0 inet static"
> the only thing that doesn't work for me on this machine is
> snort -i any.
> that only puts eth0 in promiscuous mode (using snort-mysql
> Version 1.8.7
> (Build 128)).
I launched snort with the -i option and it doesn't put my NIC in
I have to do it manually.
Does Snort set your NIC in promiscuous mode when you run it??
Thanks for any advice and help!
More information about the Snort-users