[Snort-users] snort on one interface

Joel Esler jesler at ...1935...
Wed Jul 18 16:05:09 EDT 2012


On Jul 18, 2012, at 3:46 PM, Adam <adam at ...15715...> wrote:

> So I want to run snort in ubuntu on a rackspace cloud server with only
> one interface "eth0", can this be done? Thank you.

Yes.  You'd have to issue Snort the -i eth0 command as you would any other time, but I'd also turn of tcpchecksum checking (-k none) since you are trying to sniff, essentially, you own box.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120718/c80db4d6/attachment.html>


More information about the Snort-users mailing list