[Snort-users] snort on debian monitor interface dhcp

staff staff at ...14507...
Fri Feb 6 15:28:26 EST 2009


I do not understand why you are doing that.

run 'sudo dpkg-reconfigure snort' and select the correct response to
enable/disable promiscuous mode. When you are done reconfiguring snort, it
will automatically be started.

use 'sudo invoke-rc.d snort start' when you want to turn snort on, it will
start as configured.

I have no idea why you are using 'ifconfig eth1 up promisc'.

I suggest 'man interfaces' and 'sudo vim /etc/network/interfaces'


>
> Your signature has the answer:
>
>> The computer you are using has no brain,
>> therefore you must use your own.
>>
>
>
> Shirkdog
> For the Republic
> http://www.shirkdog.us
>
>
>
>> Date: Fri, 6 Feb 2009 09:44:45 -0600
>> From: gregory at ...14510...
>> To: snort-users at lists.sourceforge.net
>> Subject: [Snort-users] snort on debian monitor interface dhcp
>>
>> When I manually initiate the monitor (eth1) interface using 'ifconfig
>> eth1 up promisc' it shows UP but then goes through the dhcp broadcast
>> and NetworkManager wipes out /etc/resolv.conf and the primary
>> interface (eth0) loses its default gateway, so I altogether lose
>> network connectivity to this box. The eth1 interface then shows a
>> 169.254.xx.xx address. Of course, I would prefer no address for the
>> snort. I would appreciate any pointers in getting the eth1 monitoring
>> interface to come up without destroying the primary network
>> parameters. Thanks in advance.
>>
>> --
>> The computer you are using has no brain,
>> therefore you must use your own.
>>
>> Gregory W Zill, MBA, CISSP
>>
>> ------------------------------------------------------------------------------
>> Create and Deploy Rich Internet Apps outside the browser with
>> Adobe(R)AIR(TM)
>> software. With Adobe AIR, Ajax developers can use existing skills and
>> code to
>> build responsive, highly engaging applications that combine the power of
>> local
>> resources and data with the reach of the web. Download the Adobe AIR SDK
>> and
>> Ajax docs to start building applications
>> today-http://p.sf.net/sfu/adobe-com
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> _________________________________________________________________
> Windows Live™: Keep your life in sync.
> http://windowslive.com/howitworks?ocid=TXT_TAGLM_WL_t1_allup_howitworks_022009------------------------------------------------------------------------------
> Create and Deploy Rich Internet Apps outside the browser with
> Adobe(R)AIR(TM)
> software. With Adobe AIR, Ajax developers can use existing skills and code
> to
> build responsive, highly engaging applications that combine the power of
> local
> resources and data with the reach of the web. Download the Adobe AIR SDK
> and
> Ajax docs to start building applications
> today-http://p.sf.net/sfu/adobe-com_______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users






More information about the Snort-users mailing list