Snort mailing list archives
Libpcap and 'ip-address-less' interfaces...
From: Peter Bates <Peter.Bates () lshtm ac uk>
Date: Wed, 05 Dec 2001 14:18:10 +0000
Hello all... I've been running snort (currently 1.8.2) for nearly a year or so now without complaint, and only the odd confused moment (on my part!)... I updated recently to a RedHat packaged (this is all running on a hacked-around RH 7.1) version of libpcap-0.6.2, and have seen the following: WARNING: OpenPcap() device eth1 network lookup: ^Ieth1: no IPv4 address assigned As you might guess, eth1 is my 'snorting' interface, brought up (as per the FAQ and many discussions here) with just ifconfig eth1 up. Snort here doesn't complain, but many other little apps I'm trying to try that rely on libpcap bomb out because of the lack of IP address. Will sticking a non-routable private IP address on this interface (which faces the 'outside' world) be OK, if it remains promiscuous, or should I be complaining to the authors of these apps to make them behave like Snort, and complain about the lack of IP address, but carry on regardless? Hope this makes some sort of sense... --------------------------------------------------------------------------------------------------------------------> Peter Bates, Systems Support Officer, Network Support Team. London School of Hygiene & Tropical Medicine. Telephone:0207-927 2124 / Fax: 0207- 636 9838 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Libpcap and 'ip-address-less' interfaces... Peter Bates (Dec 05)
- <Possible follow-ups>
- RE: Libpcap and 'ip-address-less' interfaces... Joshua Wright (Dec 05)
- Re: Libpcap and 'ip-address-less' interfaces... Fyodor (Dec 05)
- RE: Libpcap and 'ip-address-less' interfaces... Michael Aylor (Dec 05)