[Snort-users] Can snort use an unconfigured interface?

Shaun T. Erickson ste at ...11690...
Fri May 21 11:27:03 EDT 2004


I thought that you can put an initerface into promiscuous mode and grab 
packets off the wire without it being configured up. I'd swear I've done 
this in the past, but perhaps my memory fails me.

I tried to have snort use a second, connected, but unconfigured, nic, to 
listen on, but I get:

> Initializing Network Interface sis0
> ERROR: OpenPcap() device sis0 open:
>         BIOCSETIF: sis0: Network is down
> Fatal Error, Quitting..

This is on FreeBSD 5.2.1.

	-ste




More information about the Snort-users mailing list