[Snort-users] no ip on interface?

T.Shaw hshaw at ...6629...
Thu Sep 12 09:13:16 EDT 2002


Hello all.. 
this might be a stupid question.. but here goes..I have snort 1.8.7 up and running loggin to a pgsql database. I haven't installed ACID as of yet. I have configured snort to look at all traffic at an interface that currently doesnt have an ip assigned to it. Basically the interface is just up ( this is a linux box with two interfaces on it)  What im wondering is even tho i have no ip on the interface, will snort still be able to dump alerts and data into the database? Using a normal sniffer (ethereal, tcpdump) i can view the traffic on the interface by specifying the (usually) the -i parameter.  If i gave snort a smiliar parameter.. everything should be fine correct? Would this screw up reporting and alerts?

Thanks!

Terrelle Shaw




More information about the Snort-users mailing list