Snort mailing list archives
Re: e100 promisc mode
From: "Peter Param" <pparam () stvincents com au>
Date: Fri, 01 Nov 2002 10:55:34 +1100
ahh..thank you very much! 2.1.15 version of the driver (as opposed to 2.1.6d) is working much much better! :)) cheers Peter
Ben Feinstein <me () benfeinstein net> 11/01/02 09:34 AM >>>
I would't go that far. I believe I ran into this same bug that existed in v2.1.6 (and maybe other versions) of the e100 driver that broke promisc. FYI, the Linux e100 driver is written and released by INTEL, not Compaq. Try version 2.1.15, released on 8/22/2002. Works for me... [1] http://www.intel.com/support/network/adapter/1000/linux/e100.htm On Thu, 31 Oct 2002, twig les wrote:
Turn off that built-in in the BIOS and buy a new NIC. --- Peter Param <pparam () stvincents com au> wrote:Hi all, Recently installed Snort 1.9 on linux 2.4.7-10. I had to get the latest e100 driver (2.1.6) from Compaq to get it working on the machine with an inbuilt NIC. The card works but not in promisc
mode.
Doing a "ifconfig eth0 promisc" makes it look like its working in promiscuous mode but really it isn't. I confirmed this by running tcpdump alongside snort...only sees broadcasts. Another machine (an ibook with ver10) on the same segment (same hub etc) running tcpdump also, confirms that it can see all frames. I'm stumped!...any
ideas??
cheers Peter
------------------------------------------------------- This sf.net email is sponsored by: Influence the future of Java(TM) technology. Join the Java Community Process(SM) (JCP(SM)) program now. http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0004en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincent's Hospital accepts no liability for any consequential damage resulting from email containing any computer viruses. ********************************************************************** ------------------------------------------------------- This sf.net email is sponsored by: Influence the future of Java(TM) technology. Join the Java Community Process(SM) (JCP(SM)) program now. http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0004en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- e100 promisc mode Peter Param (Oct 31)
- Re: e100 promisc mode twig les (Oct 31)
- Re: e100 promisc mode Ben Feinstein (Oct 31)
- <Possible follow-ups>
- Re: e100 promisc mode Peter Param (Oct 31)
- Re: e100 promisc mode twig les (Oct 31)
- RE: e100 promisc mode Peter Param (Nov 03)
- Re: e100 promisc mode twig les (Oct 31)