RE: lost sensor

["Shawn Kottke" <skottke () DATALINK com>]

ACID does not set the sensor it only reports what it sees. Snort sets
the sensor when it starts up.

If snort was started via command line check to see what the command was.

If you do a "ps -ef | grep snort" on a *nix box you should see the
process running and the command that started it.

Otherwise check the startup script in /etc/init.d for snort and see what
it is configured like.

 

 

 

________________________________

From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Rowland,
Krisa W ERDC-ITL-MS Contractor
Sent: Thursday, March 25, 2004 10:00 AM
To: 'snort-users () lists sourceforge net'
Subject: [Snort-users] lost sensor

 

Where do I set the Sensor in ACID??