[Snort-users] eth1 and eth2 Breaks Default Route

John Crain port123tcp at ...131...
Tue Jul 22 12:50:03 EDT 2003


A buddy of mine asked the following question on comp.os.linux.networking, but those folks don't fully understand why an interface would want to be set to 0.0.0.0/0. If anyone can shed some light on a fix, I'd like to know. Here's the original question:
 
I have Red Hat 9 on an X86 with three (3) interfaces working as an IDS.  eth0 is my management interface with a live IP address.  eth1 and eth2 both have their IP addresses set to 0.0.0.0/0 for data collection.  All IP addresses are set in /etc/sysconfig/network-scripts/ifcfg-eth?.
 
When the box boots up my default route is shot through eth2 (should be eth0) even though I have my GATEWAY keyword set to the gateway I want. The following are my ifcfg-eth? entries:
 
/etc/sysconfig/network-scripts/ifcfg-eth0
     DEVICE=eth0
     ONBOOT=yes
     BOOTPROTO=static
     IPADDR=1.2.3.4
     NETMASK=255.255.255.0
     GATEWAY=1.2.3.1
 
/etc/sysconfig/network-scripts/ifcfg-eth0
     DEVICE=eth1
     BOOTPROTO=static
     BROADCAST=255.255.255.255
     IPADDR=0.0.0.0
     NETMASK=0.0.0.0
     NETWORK=0.0.0.0
     ONBOOT=yes
     GATEWAY=1.2.3.1
 
/etc/sysconfig/network-scripts/ifcfg-eth0
     DEVICE=eth2
     BOOTPROTO=static
     BROADCAST=255.255.255.255
     IPADDR=0.0.0.0
     NETMASK=0.0.0.0
     NETWORK=0.0.0.0
     ONBOOT=yes
     GATEWAY=1.2.3.1
 
I added "GATEWAY=1.2.3.1" to ifcfg-eth1 and ifcfg-eth2 to see if that would fix things.  It doesn't...
 
Q1: How do I get the system to recognize the proper gateway as specified in ifcfg-eth0?
Q2: Is there a way to tell an interface to boot in promiscous mode?  I'm thinking there is a keyword that can be placed in ifcfg-eth?, but I can't find any reference to that...


---------------------------------
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030722/49873e4e/attachment.html>


More information about the Snort-users mailing list