[Snort-users] Starting Snort Errors-Fedora3

Paul Schmehl pauls at ...6838...
Fri Mar 11 08:32:11 EST 2005


--On Friday, March 11, 2005 04:57:25 PM +0900 Mark Sargent 
<powderkeg at ...11462...> wrote:

> Hi All, am a Linux user, Fedora3. Rather new to it, and snort as well. I
> have installed snort and have apache/mysql running. Am following the
> tutorial for FC2 from Patrick S. Harper. I just tried starting snort and
> got the following,
>
>  [root at ...274... snort]# snort -i 192.168.0.12 -dev

This is incorrect.  The -i switch is used to designate the *device* you 
want to sniff on, *not* the IP address.

It *should* be this:
snort -i eth0

Try using the -T switch to verify that everything is correct in your setup.
snort -i eth0 -c /etc/snort/snort.conf -T

"-dev" means:
-d         Dump the Application Layer
-e         Display the second layer header info
-v         Be verbose

Is that what you want?

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-users mailing list