Snort mailing list archives
Re: Couple of quick questions
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Wed, 24 Mar 2004 11:40:21 +1200
On Tue, Mar 23, 2004 at 09:40:07PM +0000, Bennett Todd wrote:
I've deployed snort listening on bonded eth interfaces successully. The one quirk, which may have been fixed since, was that promisc wasn't being passed down from bond0 to the bonded ethN interfaces when snort tried to set promisc; the simple fix was to explicitly ifconfig bond0 promisc before ifenslaving the ethN interfaces; promisc _is_ propogated down to the ethN interfaces at ifenslave time.
That's weird. I've got one Snort box here using bond0 to aggregate two i82557/i82558 chipset eepro100 Ethernet cards under Linux, ifconfig doesn't show "PROMISC" anywhere on anything, and yet it's certainly running promisc as I'm seeing alerts from non-Snort IP addresses.... [I just love that "bond" feature :-). No cracks about "bond"age please! ;-)] -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Couple of quick questions Charles Lacroix (Mar 23)
- Re: Couple of quick questions Bennett Todd (Mar 23)
- Re: Couple of quick questions Jason Haar (Mar 23)
- Re: Couple of quick questions Charles Lacroix (Mar 24)
- Re: Couple of quick questions Jason Haar (Mar 23)
- Re: Couple of quick questions Bennett Todd (Mar 23)