[Snort-users] Promiscuous mode?

McCammon, Keith Keith.McCammon at ...3497...
Fri Mar 8 13:40:08 EST 2002

Are these three hosts plugged into a hub or a switch?  If they are
plugged into a switch, is the Snort sensor's switch port set to monitor
the others?

-----Original Message-----
From: Benoit Clarembeau [mailto:bclarembeau at ...5048...]
Sent: Friday, March 08, 2002 4:11 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Promiscuous mode?

Hi all.
Here is my problem: I have installed Snort+MySQL+Acid under Windows 2000
Server. No problem on the installation. I have removed all the rules and
created just 2 rules (in my local.rules file) to test only pings between
3 PCs: Snort is on xx.x.x.a, and the others are xx.x.x.b and xx.x.x.c).
Snort logs xx.x.x.a <> xx.x.x.b (or c) but not xx.x.x.b <> xx.x.x.c . In
fact, with all the rules, I can see that snort just log the traffic if
the sensor is the source or the destination... Is this a problem with my
interface? (not in promiscuous mode?) I don't know how configure that...
Who can help me? Thanks in advance.
Mail.be, Free WebMail and Virtual Office

Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list