[Snort-users] IFACE -i any problem

Edin Dizdarevic edin.dizdarevic at ...7509...
Wed Jun 4 15:29:06 EDT 2003


Anther thing..

Marcus Robb wrote:
> Hi, 
> 
> I'm sure this is an old issue, but I can't find a resolution. 
> I've found posts that say libpcap has been able to 
> listen on multiple interfaces for several versions now.
> 
> I have a redhat 7.3 system with 5 nics, 4 of the nics cover multiple paths, 1 is a management interface.
> I only expect to capture packets on 2 of the promiscuous nics at any time.

That won't work too since promisc mode with "-i any" is not
possible... :-\


> The IFACE=any option would be perfect for me.
> Snort 2.0 and the latest libpcap are both compiled from the latest stable sources.
>  
> When I try to start snort with the -i any switch I have errors in /var/log/messages
> that say "modprobe can't find module any."
> Snort starts but then no longer sees traffic on any of the interfaces.
> If I start Snort on a single interface, say eth1, it works just fine.
> 
> Can anyone point me in the right direction please. My searches keep turning up nada
> for a solution.
> 
> Thanks
> 

Regards,

Edin

-- 
Edin Dizdarevic





More information about the Snort-users mailing list