[Snort-users] Re: Snort on Linux with no IP

Gabriel L. Somlo somlo at ...8241...
Tue Feb 24 11:09:01 EST 2004

I think the Linux kernel names all ethernet interfaces 'ethX' with X
starting at 0 and incrementing as more cards are detected.

You can then use the 'nameif' command to talk the kernel into renaming
them to whatever ASCII string you want...

Redhat probably doesn't do anything beyond going with whatever the
kernel names the cards by default...

Just my $0.02 :)


On Tue, Feb 24, 2004 at 10:36:01AM -0800, snort-users-request at lists.sourceforge.net wrote:
> Message: 1
> Subject: RE: [Snort-users] Snort on Linux with no IP
> Date: Tue, 24 Feb 2004 10:22:07 -0600
> From: "Schmehl, Paul L" <pauls at ...6838...>
> To: "Yonah Russ" <yonah at ...11275...>,
> 	"Brian McNeilly" <bmcneilly at ...9344...>
> Cc: <snort-users at lists.sourceforge.net>
> > eth1 is the name for the second network card in a BSD or=20
> > Linux machine.=20
> > Each network card is called eth for ethernet  and is number=20
> > from 0 and=20
> > up to however many network cards you have (minus 1).
> >=20
> This is not true.  The handle for the NIC depends upon the manufacturer
> in BSD.  For example, xl0 and xl1 are two NICs on one FreeBSD box I
> have.  I don't recall if RedHat always uses the eth0, eth1 convention,
> but the BSDs definitely do not.

More information about the Snort-users mailing list