[Snort-users] capturing on the wrong nic

Chris Copeland roninuta at ...11827...
Mon Oct 18 20:41:41 EDT 2010


Yep, total newbie here, but I have managed to do the following:
install LAMP, install snort, configure 2 eth devices, install base,
and capture traffic, the only problem is that it is traffic on the
management nic, not the nic I have plugged in to my hub (the one I
want sniffing).

topology:
cable modem
-> hub -> snortTest
-> hub -> firewall/wireless router -> home network devices

I know this has to be a setting in the conf file, at least I think it does.

My internal IP: 10.0.1.15
from the snort.conf:
var HOME_NET 10.0.1.0/24
var EXTERNAL_NET any

eth0 - management nic
eth1 - sniffer nic

what am I doing wrong?

Thanks in advance!!!




More information about the Snort-users mailing list