[despammed] [Snort-users] DSL Monitoring

Ed McMan essmilee at ...5068...
Sun May 5 21:48:05 EDT 2002


You want to monitor ppp0... eth1 would be the PPPoE which I doubt snort
supports ;)
-------------------------------------------------------------
|   Eddie J Schwartz <EdMcMan at ...5792...> http://www.m00.net   |
|   AIM: The Cypher ICQ: 35576339 YHOO: edmcman2 MSN: ^^    |
| "We Trills have an expression--at forty, you think you    |
| know everything.  At four hundred, you realize you know   |
|         nothing." - Dax, Star Trek Deep Space 9           |
-------------------------------------------------------------
----- Original Message -----
From: "Darren Young" <darren_young at ...131...>
To: <snort-users at lists.sourceforge.net>
Sent: Sunday, May 05, 2002 12:04 PM
Subject: [despammed] [Snort-users] DSL Monitoring


> I'd like to start monitoring my home DSL connection
> with Snort, but am not sure which interface to watch.
> Sitting behind my NetDSL modem is a RedHat Linux
> system that runs PPPOE to establish a connection to
> Earthlink. The interface eth1 is physically attached
> to the DSL modem and ppp0 is the one that the PPPOE
> software brings up for the actual connection.
>
> When I apply firewall rules, I add them against the
> ppp0 interface, would I use the same one for Snort or
> the eth1 physical interface? Should I place a hub on
> the same connection as the DSL and add another
> interface just for Snort monitoring?
>
> Any pointers would be great.






More information about the Snort-users mailing list