[Snort-users] snort-mysql sensors

Will Metcalf william.metcalf at ...11827...
Tue Jun 21 11:48:49 EDT 2005


I'm guessing that the IP or name changed because if you are in
Inlinemode() escapedInterfaceName is always equal to NULL so if we are
in Inlinemode() we always set escapedInterfaceName = inline.

Regards,

Will
On 6/21/05, Miner, Jonathan W (CSC) (US SSA)
<jonathan.w.miner at ...11338...> wrote:
> If you change the interface, like switching from eth0 to eth1, or change the IP address you will end up with multiple sensor entries.  I don't think you can fix it via BASE. but you might be able to go into to mysql and change the table directly.
> 
>         -----Original Message-----
>         From: snort-users-admin at lists.sourceforge.net on behalf of Mohamed Eldesoky
>         Sent: Tue 06/21/2005 10:01 AM
>         To: Snort Users
>         Cc:
>         Subject: [Snort-users] snort-mysql sensors
> 
> 
> 
>         At last I have run snort-mysql and BASE on my bridged firewall.
>         I have two interfaces working, but BASE reports that I have three sensors ??
>         Howcome ???
> 
>         --
>         Mohamed Eldesoky
>         www.eldesoky.net
>         RHCE
> 
> 
>         -------------------------------------------------------
>         SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
>         from IBM. Find simple to follow Roadmaps, straightforward articles,
>         informative Webcasts and more! Get everything you need to get up to
>         speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=ick
>         _______________________________________________
>         Snort-users mailing list
>         Snort-users at lists.sourceforge.net
>         Go to this URL to change user options or unsubscribe:
>         https://lists.sourceforge.net/lists/listinfo/snort-users
>         Snort-users list archive:
>         http://www.geocrawler.com/redir-sf.php3?list=ort-users
> 
> 
>




More information about the Snort-users mailing list