[Snort-users] no ip addr. on 2nd interface (more info)

Wirth, Jeff WirthJe at ...4876...
Thu Sep 12 12:13:05 EDT 2002


From: T.Shaw [mailto:hshaw at ...6629...]

> 
> Hello all, Thanks for the responces.. 
> Since i have this setup and working.. the hard part is done.. 
> now im wondering ( its been up for more than two weeks) why i 
> dont see any thing in the database. In setting up the 

Sounds like you have a switched network (based on the vlan comment below),
are your switches configured to forward to a monitoring port? If not this
might explain why you are not seeing any traffic. Throw snort in sniffer
mode, do you see any traffic????

I am on a switched network.. http://www.snort.org/docs/faq.html#1.8

> snort.conf file.. what exactly would be my HOME_NET set to?  

What is it set to now?

> We have multiple vlans internally.. could i just list them 
> all out? or "super" net them with like a /16 or something? ( 
> we have internal 192.168.x.x nets)
> 

how to set HOME_NET.. http://www.snort.org/docs/faq.html#3.3

- Jeff




More information about the Snort-users mailing list