[Snort-users] Can snort use an unconfigured interface?

Matt Kettler mkettler at ...4108...
Fri May 21 14:35:01 EDT 2004

At 02:26 PM 5/21/2004, Shaun T. Erickson wrote:
>I thought that you can put an initerface into promiscuous mode and grab 
>packets off the wire without it being configured up. I'd swear I've done 
>this in the past, but perhaps my memory fails me.

You don't need it to be configured, but you do need it to be up.

Just use ifconfig to force it into the up state and you'll be fine. It's 
covered in the FAQ on the website under "stealth interfaces"

More information about the Snort-users mailing list