[Snort-users] var HOME_NET under Linux
erek at ...950...
Fri Jun 27 15:58:01 EDT 2003
On Fri, 27 Jun 2003, Thomas Bechtold wrote:
> What you wiht replace eth0? eth0 _is_ my Interface.
> I use now the standard-config file and ony edit the line with the var HOME_NET
> Now i have the following line in my snort.conf
> var HOME_NET $eth1_ADDRESS
> Initializing Network Interface ppp0
> --== Initializing Snort ==--
> Initializing Output Plugins!
> Decoding raw data on interface ppp0
Well, it looks like you're not starting Snort on the right interface.
Snort will default to start on the "first" interface that it finds. In
this case that looks to be ppp0. Since you want Snort to use eth0, then
you need to specify that.
snort -c /path/to/snort.conf -i eth0
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-users