Snort mailing list archives

Changing the interface


From: "Vernon Webb" <vernon () comp-wiz com>
Date: Sat, 18 Dec 2004 19:30:39 -0500

How do I change the interface for logging on SNORT? In the startup script I have changed the INTERFACE to eth1 however 
it is still logging from eth0, what's up with that? Here's what my start up script says now:

source /etc/rc.d/init.d/functions
source /etc/sysconfig/network

### Check that networking is up.
[ "${NETWORKING}" == "no" ] && exit 0

[ -x /usr/sbin/snort ] || exit 1
[ -r /etc/snort/snort.conf ] || exit 1

### Default variables
SYSCONFIG="/etc/sysconfig/snort"
OPTIONS="-s -d"
INTERFACE="eth1"
USER="snort"

### Read configuration
[ -r "$SYSCONFIG" ] && source "$SYSCONFIG"

RETVAL=0
prog="snort"
desc="Intrusion Detection System"

start() {
 echo -n $"Starting $desc ($prog): "
 cd /var/log/snort
 daemon $prog -u $USER -g $USER -D -i $INTERFACE -l /var/log/snort -c /etc/snort/snort.conf $OPTIONS
 RETVAL=$?
 echo
 [ $RETVAL -eq 0 ] && touch /var/lock/subsys/$prog
 return $RETVAL
}

stop() {
 echo -n $"Shutting down $desc ($prog): "
 killproc $prog
 RETVAL=$?
 echo
 [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog
 return $RETVAL
}

restart() {
 stop
 start
}

reload() {
 echo -n $"Reloading $desc ($prog): "
 killproc $prog -HUP
 RETVAL=$?
 echo
 return $RETVAL
}

dump() {
 echo -n $"Dumping $prog database to syslog: "
 killproc $prog -USR1
 RETVAL=$?
 echo
 return $RETVAL
}

case "$1" in
  start)
 start
 ;;
  stop)
 stop
 ;;
  restart)
 restart
 ;;
  reload)
 reload
 ;;
  condrestart)
 [ -e /var/lock/subsys/$prog ] && restart
 RETVAL=$?
 ;;
  status)
 status $prog
 RETVAL=$?
 ;;
  dump)
 dump
 ;;
  *)
 echo $"Usage: $0 {start|stop|restart|reload|condrestart|status|dump}"
 RETVAL=1
esac

exit $RETVAL

 

Current thread: