Snort mailing list archives

IFACE -i any problem


From: "Marcus Robb" <MRobb () mpsbc com>
Date: Wed, 4 Jun 2003 13:51:23 -0700

Hi, 

I'm sure this is an old issue, but I can't find a resolution. 
I've found posts that say libpcap has been able to 
listen on multiple interfaces for several versions now.

I have a redhat 7.3 system with 5 nics, 4 of the nics cover multiple paths, 1 is a management interface.
I only expect to capture packets on 2 of the promiscuous nics at any time.
The IFACE=any option would be perfect for me.
Snort 2.0 and the latest libpcap are both compiled from the latest stable sources.
 
When I try to start snort with the -i any switch I have errors in /var/log/messages
that say "modprobe can't find module any."
Snort starts but then no longer sees traffic on any of the interfaces.
If I start Snort on a single interface, say eth1, it works just fine.

Can anyone point me in the right direction please. My searches keep turning up nada
for a solution.

Thanks

Current thread: