[Snort-users] stealth interface

Matt Kettler mkettler at ...4108...
Mon Apr 7 13:19:09 EDT 2003


This is in the FAQ you read, you just failed to read the first answer and 
skipped straight to the third one.

http://www.snort.org/docs/faq.html#3.1


3.1 --faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq--

Q: How do I setup snort on a 'stealth' interface?

A: Bring up the interface without an IP address on it. See FAQ 3.2...
    http://www.geocrawler.com/archives/3/4890/2000/9/0/4399696/


<snipped off the other answers involving read-only cables and taps>



3.2 --faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq--


Q: How do I run snort on an interface with no IP address?

A: ifconfig eth1 up







At 03:26 PM 4/7/2003 -0400, d_greenjr wrote:
>Can someone tell me or give me the URL on how to create an interface with 
>no ipaddr (stealth), on a linux [RH8] system? (Not the receive only 
>cable-I saw that in the snort FAQs)  I have searched the Internet and the 
>snort archives but have not found a message/page that describes what to 
>do-only the end results.  Thanks
>





More information about the Snort-users mailing list