icmp again

["snortlst snortlst" <snortlst () hotmail com>]

I'm still having the sane weird thing and I cannot understand why this
happens:
Snort box (1 nic) connected to the switch and 3 ports (firewall, vpn,
router) are mirrored to the port where snort is connected.
I see only ICMP traffic in alert file. Why?

P.S nic is set to promisc (see it in ifconfig) but snort doesn't set it
automatically, I had manually issue ifconfig eth0 promisc before starting
snort.

Help.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users