[Snort-users] RE: stealth interface

Sanderson, Josh JoshS at ...8828...
Wed Apr 9 12:03:09 EDT 2003

I was able to do that on Windows XP and 2000 by not binding any service or
protocol to the network card. If you want to connect through that interface
occasionally simply bind the TCP/IP protocol but uncheck it's box in the
connection configuration during normal monitoring. In linux I think it is
just /sbin/ifconfig eth0 -up .

Also, in response to Eric Baur's next mystery, can't you simply create a
symbolic link to ethX in the dev directory? Seems like I saw that mentioned
in a howto somewhere - possibly the Gentoo.org setup instructions.

>Is something like this possible on a windows system?

>Eric Baur wrote:
>     That seems to be working in my installation (also RH8.0) without=20
> any issues.  (Now, my next mystery is seeing if I can find a way to=20
> refer to the devices as "lan", "wan" and "dmz" instead of "eth1",=20
> "eth2" and "eth3".)
> =20
> Eric
>  =20
> d_greenjr wrote:
>>     Can someone tell me or give me the URL on how to create an
>>     interface with no ipaddr (stealth), on a linux [RH8] system? (Not
>>     the receive only cable-I saw that in the snort FAQs)  I have
>>     searched the Internet and the snort archives but have not found a
>>     message/page that describes what to do-only the end results.  =

More information about the Snort-users mailing list