[Snort-users] snort newbie help

Guillermo Padilla gpadilla at ...13098...
Mon Feb 28 08:31:34 EST 2005


Hi,

I just recently installed snort on RH9.0 with apache-myslq-php-acid
etc.. The front end of the snort seems to be working fine. 

The server that snort is installed on has 5 interfaces but 4 will be
used as taps.  I'm having problems figuring out how to get snort to only
listen on just those 4 interfaces.  If I set up my startup script to
iface=any it only starts looping localhost alerts.  If I add iface=eth1
it looks like its seeing traffic on that interface.  Right now I've only
plugged all interfaces onto a hub where my windows machine is also plug
to the the uplink port is connected to a switch which in turns goes out
to the cloud.

I want to see if I can see the traffic which is happening on my windows
machine.

All the interfaces do not have ip address except eth0.  

Can anyone point me into the right derection?

Regards,

-Guillermo





More information about the Snort-users mailing list