Snort mailing list archives

Re: e100 promisc mode


From: "Peter Param" <pparam () stvincents com au>
Date: Fri, 01 Nov 2002 10:55:34 +1100

ahh..thank you very much!  2.1.15 version of the driver (as opposed to
2.1.6d) is working much much better!  :))

cheers
Peter

Ben Feinstein <me () benfeinstein net> 11/01/02 09:34 AM >>>
I would't go that far.  I believe I ran into this same bug that existed
in
v2.1.6 (and maybe other versions) of the e100 driver that broke promisc.
FYI, the Linux e100 driver is written and released by INTEL, not Compaq.

Try version 2.1.15, released on 8/22/2002.  Works for me...

[1]  http://www.intel.com/support/network/adapter/1000/linux/e100.htm

On Thu, 31 Oct 2002, twig les wrote:

Turn off that built-in in the BIOS and buy a new NIC.

--- Peter Param <pparam () stvincents com au> wrote:
Hi all,

Recently installed Snort 1.9 on linux 2.4.7-10.  I had to get the
latest e100 driver (2.1.6) from Compaq to get it working on the
machine with an inbuilt NIC.  The card works but not in promisc
mode.
Doing a "ifconfig eth0 promisc" makes it look like its working in
promiscuous mode but really it isn't.  I confirmed this by running
tcpdump alongside snort...only sees broadcasts.  Another machine (an
ibook with ver10) on the same segment (same hub etc) running tcpdump
also, confirms that it can see all frames.  I'm stumped!...any
ideas??

cheers
Peter




-------------------------------------------------------
This sf.net email is sponsored by: Influence the future 
of Java(TM) technology. Join the Java Community 
Process(SM) (JCP(SM)) program now. 
http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0004en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been
virus scanned and although no viruses were detected by the system,
St Vincent's Hospital accepts no liability for any consequential
damage resulting from email containing any computer viruses.

**********************************************************************


-------------------------------------------------------
This sf.net email is sponsored by: Influence the future 
of Java(TM) technology. Join the Java Community 
Process(SM) (JCP(SM)) program now. 
http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0004en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: