Re: var HOME_NET under Linux

[Erek Adams <erek () snort org>]

On Fri, 27 Jun 2003, Thomas Bechtold wrote:

> What you wiht replace eth0? eth0 _is_ my Interface.
> I use now the standard-config file and ony edit the line with the var HOME_NET
> Now i have the following line in my snort.conf
>
> var HOME_NET $eth1_ADDRESS

[...snip...]

> Initializing Network Interface ppp0
>
>         --== Initializing Snort ==--
> Initializing Output Plugins!
> Decoding raw data on interface ppp0

[...snip...]

Well, it looks like you're not starting Snort on the right interface.
Snort will default to start on the "first" interface that it finds.  In
this case that looks to be ppp0.  Since you want Snort to use eth0, then
you need to specify that.

        snort -c /path/to/snort.conf -i eth0

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users