[Snort-users] Snort will not detect anything on stealth interface unless I assign IP

Jason Haar Jason.Haar at ...294...
Sun Jul 18 16:28:07 EDT 2004


On Sat, Jul 17, 2004 at 12:10:25PM -0700, Rhugga wrote:
> 
> I have attached 1 interface of from ISD box a hub containing our border 
> router and our 2 firewalls. I bring the interface up with no IP address 
> and snort will not start due to $eth1_ADDRESS being null.

Well that's not right. I've run snort from RH7 to Fedora Core2 and it
doesn't need an IP address.

However, the interface has to be UP.

Make sure your /etc/sysconfig/network-scripts/ifcfg-ethX looks like this:

DEVICE=eth1
ONBOOT=yes
BOOTPROTO=static
IPADDR=0.0.0.0
NETMASK=0.0.0.0

Change ethX appropriately.

> snort will start when eth1 has this dummy IP address but no rules are 
> getting detected.

What does tcpdump on that interface show? If it can't see traffic, then
neither can snort. Actually "snort -v -i ethX" should do the same.

> When I put a valid IP address on that interface in the same net as the 
> router and firewalls, snort then starts matching rules...

Err... Now you're just getting freaky :-)

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1




More information about the Snort-users mailing list