[Snort-users] stealth interface

Matt Yackley Matt.Yackley at ...5858...
Mon Apr 7 13:12:14 EDT 2003


I have two NICs in my machine, the external nic (eth0) is set to not
automatically start, and has no IP settings.  the second NIC (eth1) has an
internal address and is set to automatically start.  Once the machine is
running simply run "ifconfig eth0 up" this should enable the NIC without an
address, do a "ifconfig" to get a list, eth0 should be up & running with no
IP address.  For further safety you may also want to diasble ARP on the NIC,
I think you should be able to do this by running "ifconfig -arp eth0"

HTH,
Matt


>>example output
eth0 Link encap:Ethernet HWaddr 00:01:02:CC:26:09 
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:23906075 errors:1 dropped:0 overruns:0 frame:1
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100 
RX bytes:596401091 (568.7 Mb) TX bytes:0 (0.0 b)
Interrupt:9 Base address:0xe400
 
eth2 Link encap:Ethernet HWaddr 00:60:08:3D:62:59 
inet addr:x.x.x.x Bcast:x.x.x.x Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:626874 errors:0 dropped:0 overruns:0 frame:0
TX packets:183056 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100 
RX bytes:63624628 (60.6 Mb) TX bytes:31406687 (29.9 Mb)
Interrupt:10 Base address:0xec00 

-----Original Message-----
From: d_greenjr [mailto:d_greenjr at ...125...]
Sent: Monday, April 07, 2003 2:27 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] stealth interface


Can someone tell me or give me the URL on how to create an interface with no
ipaddr (stealth), on a linux [RH8] system? (Not the receive only cable-I saw
that in the snort FAQs)  I have searched the Internet and the snort archives
but have not found a message/page that describes what to do-only the end
results.  Thanks




More information about the Snort-users mailing list