RE: running snort questions

["Daniel Lopez" <dlopez () tct hut fi>]

<snip>

> you can still use the interfaces file:
>
> [root@sched:/etc/network]# cat interfaces
>
> <snip>
>
> iface eth2 inet static
>
> <snip>
>
> works for me:
>
> [root@sched:/etc/network]# ifconfig
> eth0      Link encap:Ethernet  HWaddr 00:80:C8:B9:F9:C9
>            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>            RX packets:450630038 errors:9 dropped:0 overruns:0 frame:15
>            TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
>            collisions:0 txqueuelen:100
>            RX bytes:209873534 (200.1 MiB)  TX bytes:0 (0.0 b)
>            Interrupt:10 Base address:0xa800


I have the same on my /etc/network/interfaces file:

iface eth0 inet static

and when I do a "ifconfig", I can see that my eth0 interface is not up!
Only the lo interface is up. To be able to see the eth0 interface up, I
have to put the options
address and netmask after "iface eth0 inet static"
Any idea?

> the only thing that doesn't work for me on this machine is
> snort -i any.
> that only puts eth0 in promiscuous mode (using snort-mysql
> Version 1.8.7
> (Build 128)).


I launched snort with the -i option and it doesn't put my NIC in
promiscuous mode.
I have to do it manually.
Does Snort set your NIC in promiscuous mode when you run it??

Thanks for any advice and help!

Daniel



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users