[Snort-users] Setting the nic up ??

Erek Adams erek at ...577...
Mon Jun 10 15:22:02 EDT 2002


On Mon, 10 Jun 2002, Walgamotte, David wrote:

>
> Similar, however the mtu is 1500. It just seems to pickup arp packets. Its
> is also plugged into a switch directly connected to the internet. I started
> up snort and nothing, here is the ifconfig -a
>
> bash-2.00# ifconfig -a
> lo0: flags=849<UP,LOOPBACK,RUNNING,MULTICAST> mtu 8232
>         inet 127.0.0.1 netmask ff000000
> hme1: flags=8c3<UP,BROADCAST,RUNNING,NOARP,MULTICAST> mtu 1500
>         inet 0.0.0.0 netmask 0
>         ether 8:0:20:b2:f7:e3

[...snip...]

>     ARP: 16         (100.000%)

[...snip...]

That's all you _should_ see--Unless you have some way to mirror/span the other
ports to your data port on the switch.

Have a look at:

	http://www.snort.org/docs/faq.html#1.8
and

	http://www.snort.org/docs/faq.html#6.21

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list