[Snort-users] New User interface question

Chris McClimans snort-users at ...12733...
Mon Mar 7 12:57:43 EST 2005


For monitoring interfaces I use the manual method and put the commands 
in the network config ala /etc/network/interfaces. (this is probably 
debian specific)

auto bond0
iface bond0 inet manual
         pre-up ifconfig eth1 up && ifconfig eth2 up && ifconfig bond0 up
         up ifenslave bond0 eth1 eth2
         down ifenslave -d bond0 eth1 eth2
         post-down ifconfig eth1 down && ifconfig eth2 down && ifconfig 
bond0 down

auto eth3
iface eth3 inet manual
         up ifconfig eth3 up
         down ifconfig eth3 down

On Mar 02, 2005, at 15:03, Mike Lieberman wrote:

>
> I am configuring a Debian server with three NICs and have SNORT 2.3 
> loaded.
>
> 	eth0 has an IP address and is not for SNORT use
> 	eth1 and eth2 do not have IP addresses and are to be used in
> promiscuous mode.
>
> 		auto eth0
> 		iface eth0 inet static
> 		    address 10.0.0.21
> 		    netmask 255.255.255.0
> 		    network 10.0.0.0
> 	          broadcast 10.0.0.255
>         	    gateway 10.0.0.225
> 		auto eth1
> 		iface eth1 inet manual
> 		auto eth2
> 		iface eth2 inet manual
>
> I can bring the eth1 and eth2 interfaces up manually with 	
> 	ifconfig eth(x) up
>
> I understand I can put a script in ifup.d to force the interfaces up.
>
> So that I can load snort from boot, is this the best way to set this 
> up? If
> so, does anyone have a sample script?
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real 
> users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>





More information about the Snort-users mailing list