Snort mailing list archives
Linux Snort Stealth Interface Help Request
From: "Mark Gannon" <markgannon () rcsis com>
Date: Sat, 16 Mar 2002 10:03:32 pdt
Hello, I'm having difficulty implementing a stealth inteface per Snort FAQs 3.1 and 3.2 on a Linux (SuSE 7.3 with kernel 2.4.14) system using a regular straight through cable. I start snort and no traffic is displayed to stdout even though another interface on the same segment shows traffic via tcpdump. Here is the command I'm issueing: akme:/home/markg # snort -dvi eth1 Log directory = --== Initializing Snort ==-- Initializing Network Interface eth1 WARNING: OpenPcap() device eth1 network lookup: eth1: no IPv4 address assigned Decoding Ethernet on interface eth1 --== Initialization Complete ==-- -*> Snort! <*- Version 1.8.1-RELEASE (Build 74) By Martin Roesch (roesch () sourcefire com, www.snort.org) -------------------------------------------------------------------------------------------- After that no traffic is ever displayed. I've also tried dumping to standard out with tcpdump, but I never see any traffic. After issueing the ifconfig eth1 0.0.0.0 command, the ifconfig output looks like: eth0 Link encap:Ethernet HWaddr 00:10:5A:0C:70:FA inet addr:192.168.1.2 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:26435 errors:0 dropped:0 overruns:0 frame:0 TX packets:27334 errors:0 dropped:0 overruns:0 carrier:0 collisions:14 txqueuelen:100 RX bytes:18351898 (17.5 Mb) TX bytes:3004806 (2.8 Mb) Interrupt:10 Base address:0xdc00 eth1 Link encap:Ethernet HWaddr 00:01:03:CC:CC:21 UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:1330 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:79532 (77.6 Kb) TX bytes:0 (0.0 b) Interrupt:11 Base address:0xe800 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:201 errors:0 dropped:0 overruns:0 frame:0 TX packets:201 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:16743 (16.3 Kb) TX bytes:16743 (16.3 Kb) Even though the RX Bytes occasionally increments, no output is displayed. Eth1 is connected to a Netgear Dual Speed Hub (DS 106) that has a link light on for that connection. I've tried different cables and different NICS. Right now the NIC on eth1 is 3c905c and eth0 is a 3c905b using the driver that comes with kernel version 2.4.14 as a module. When I start Snort on eth0, all the traffic is dumped to standard out. Thanks for your help. Regards, Mark Gannon markgannon () rcsis com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Linux Snort Stealth Interface Help Request Mark Gannon (Mar 21)
- Re: Linux Snort Stealth Interface Help Request Chris Green (Mar 21)