[Snort-users] var HOME_NET under Linux

Erek Adams erek at ...950...
Fri Jun 27 15:58:01 EDT 2003

On Fri, 27 Jun 2003, Thomas Bechtold wrote:

> What you wiht replace eth0? eth0 _is_ my Interface.
> I use now the standard-config file and ony edit the line with the var HOME_NET
> Now i have the following line in my snort.conf
> var HOME_NET $eth1_ADDRESS


> Initializing Network Interface ppp0
>         --== Initializing Snort ==--
> Initializing Output Plugins!
> Decoding raw data on interface ppp0


Well, it looks like you're not starting Snort on the right interface.
Snort will default to start on the "first" interface that it finds.  In
this case that looks to be ppp0.  Since you want Snort to use eth0, then
you need to specify that.

	snort -c /path/to/snort.conf -i eth0


Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson

More information about the Snort-users mailing list