RE: Promiscuous mode?

["McCammon, Keith" <Keith.McCammon () eadvancemed com>]

Are these three hosts plugged into a hub or a switch?  If they are
plugged into a switch, is the Snort sensor's switch port set to monitor
the others?

-----Original Message-----
From: Benoit Clarembeau [mailto:bclarembeau () mail be]
Sent: Friday, March 08, 2002 4:11 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Promiscuous mode?


Hi all.
Here is my problem: I have installed Snort+MySQL+Acid under Windows 2000
Server. No problem on the installation. I have removed all the rules and
created just 2 rules (in my local.rules file) to test only pings between
3 PCs: Snort is on xx.x.x.a, and the others are xx.x.x.b and xx.x.x.c).
Snort logs xx.x.x.a <> xx.x.x.b (or c) but not xx.x.x.b <> xx.x.x.c . In
fact, with all the rules, I can see that snort just log the traffic if
the sensor is the source or the destination... Is this a problem with my
interface? (not in promiscuous mode?) I don't know how configure that...
Who can help me? Thanks in advance.
-----------------------------------------------------
Mail.be, Free WebMail and Virtual Office
http://www.mail.be


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users