[Snort-users] Re: Snort & Acid

Colin.Slevin at ...9238... Colin.Slevin at ...9238...
Wed May 21 06:07:09 EDT 2003


I am having another problem , I have two network cards on my machine one
for sniffing and on for normal network activity . When I type snort -W I
get these two NIC cards which are correct . But the card I want to sniff is
the second but snort is using the first even when I specify the second in
the snort .conf . What do I do to change the situation . I know that one
should be in promiscious mode but all traffic seems to be directed through
this card . I using snort on Win2k with mysql and acid and obviously php.
\Device\NPF_{37B8DFB9-9F3C-4585-BF8C-F65A3422564B} (Intel 8255x-based
Integrated Fast Ethernet) normal traffic  (IP 10.0.0.46)
\Device\NPF_{185E1F8A-0E33-4774-9193-076063E4A164} (Compac
Ethernet/FastEthernet or Gigabit NIC) promiscious mode (IP 10.0.0.47) I
don't think that this should have an IP address so if you can also tell me
how to get this to sniff without an IP address that would great too ...


Thanks alot

Colin






More information about the Snort-users mailing list