[Snort-users] Network Interface Issue in Ubuntu 16.04

Noah Dietrich noah_dietrich at ...17393...
Wed Feb 15 03:51:24 EST 2017


Beginning with Ubuntu 15.10, network interfaces no longer follow the ethX
standard (eth0, eth1, …). Instead, interfaces names are assigned as Predictable
Network Interface Names
<http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/>.
This means you need to check the names of your interfaces using *ifconfig
-a*. In my case, what was originally eth0 is now ens160 on a vSphere
virtual machine.

Also, If you are looking to run snort as an IPS (as your subject line
indicates, rather than an IDS), you'll need two interfaces, not just one.
You specify the interfaces using the following flags when running Snort: * -Q
-i eth1:eth2* (modify eth1 and eth2 to match your two network interfaces,
based on the output from *ifconfg -a*

Noah


On Tue, Feb 14, 2017 at 10:06 PM, James Lay <jlay at ...13475...>
wrote:

> On 2017-02-14 13:02, tantioification . wrote:
> > Hi,
> >
> > I'm newer in snort.
> > i have a problem when i try to install IPS in Ubuntu 16.04.
> > The error message is below:
> >
> > ERROR: Can't initialize DAQ afpacket (-1) - afpacket_daq_initialize:
> > Invalid interface specification: 'enp4s0'!
> > Fatal Error, Quitting..
> >
> > I think this problem because in Ubuntu 16.04 no longer follow the ethX
> > standard for network interface name.
> > Where i can find or configure afpacket_daq_initialize with valid
> > network interface name?
> >
> > Thank you for help.
> >
> > Sorry for my grammar :D
>
>
> I've not seen this...can you do a "sudo ifconfig -a"?
>
> James
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170215/96790ad1/attachment.html>


More information about the Snort-users mailing list