[Snort-users] RE: stealth interface

Eric Baur Eric.Baur at ...8629...
Thu Apr 10 09:05:22 EDT 2003

	That was my first thought as well... unfortunatly, it appears that
the ethernet devices are not in the /dev directory, but "created" by the
kernel on the fly.  (Kind of makes sense, really, since you never refer to
them as /dev/eth0 as you would a disk.)
	Anyway, you can use aliases (and clones?) to make something like
eth0:LAN or eth1:DMZ show up, but only on numbered interfaces, not stealth
ones.  You can also give it a nickname, but that only works for the ifup and
ifdown scripts (in RedHat), not for things like ethereal or snort.
Frustrating, but at this point I'm now assuming it isn't possible to use a
truly arbitrary name.


-----Original Message-----
From: Sanderson, Josh [mailto:JoshS at ...8828...] 
Sent: Wednesday, April 09, 2003 12:14 PM
To: 'snort-users at lists.sourceforge.net'
Subject: [Snort-users] RE: stealth interface


Also, in response to Eric Baur's next mystery, can't you simply create a
symbolic link to ethX in the dev directory? Seems like I saw that mentioned
in a howto somewhere - possibly the Gentoo.org setup instructions.


More information about the Snort-users mailing list