[Snort-users] DAQ and ppp
jlay at ...13475...
Fri Dec 7 13:14:34 EST 2012
On 2012-12-07 11:10, Greg Williams wrote:
> Ppp0 should be its own interface. Try: sudo snort --daq afpacket -c
> intsnort.conf -i ppp0
> -----Original Message-----
> From: James Lay [mailto:jlay at ...13475...]
> Sent: Friday, December 07, 2012 11:07 AM
> To: Snort-users
> Subject: [Snort-users] DAQ and ppp
> Quick question...trying to run:
> sudo snort --daq afpacket -c intsnort.conf -i eth0:ppp0
> And I get:
> ERROR: Can't start DAQ (-1) - start_instance: invalid interface type
> for device ppp0: 512 != 1!
> This is 184.108.40.206. Any hints on what this could be? Cursory google
> wasn't fruitful. Thanks all!
Hrmm....my whole testing of this was to have one instance of snort,
listening to two interfaces. My tests worked with eth0 and
say...another eth1 or eth2. Even worked with eth0:wlan0. Is this not a
possibility with ppp interfaces? And that's for the quick response
More information about the Snort-users