[Snort-users] Snort not running on eth1

Matt Kettler mkettler at ...4108...
Fri Jul 9 10:11:01 EDT 2004

At 12:21 PM 7/9/2004, Patrick Marquetecken wrote:
>If i try to start snort on eth1 i get this error:
>snort -I eth1 -c /etc/snort/snort.conf

try snort -i eth1 -c /etc/snort/snort.conf

The parameter you want is lower-case, not upper case.

-I causes snort to print the receiving interface name in the logs, and 
accepts no parameters
-i selects an interface by name, and the name of the interface follows.

Since you used capital I, snort is treating "eth1" as a bpf declaration, 
which isn't valid bpf syntax and it fails. 

More information about the Snort-users mailing list