[Snort-users] Snort will not detect anything on stealth interface unless I assign IP

Paul Schmehl pauls at ...6838...
Sat Jul 17 13:51:00 EDT 2004


--On Saturday, July 17, 2004 12:10 PM -0700 Rhugga 
<snort-list at ...12135...> wrote:
>
> How do you use a shadow interface with no IP address with snort? I am
> running RH 9.
>
When you start snort, you need to tell it what interface to use and what 
conf file to use.

If you're going to run two instances of snort on the same box with two 
interfaces, then you'd do something like this:

snort -i eth0 -c /etc/snort1.conf -D
snort -i eht1 -c /etc/snort2.conf -D

Each conf file would point to a separate database.

(Use whatever other switches you need.  For more information on what's 
available, run snort --help from the commandline.  You may have to pipe it 
through a pager to see everything - snort --help | less, for example.)

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-users mailing list