Snort mailing list archives
Changing the interface
From: "Vernon Webb" <vernon () comp-wiz com>
Date: Sat, 18 Dec 2004 19:30:39 -0500
How do I change the interface for logging on SNORT? In the startup script I have changed the INTERFACE to eth1 however it is still logging from eth0, what's up with that? Here's what my start up script says now: source /etc/rc.d/init.d/functions source /etc/sysconfig/network ### Check that networking is up. [ "${NETWORKING}" == "no" ] && exit 0 [ -x /usr/sbin/snort ] || exit 1 [ -r /etc/snort/snort.conf ] || exit 1 ### Default variables SYSCONFIG="/etc/sysconfig/snort" OPTIONS="-s -d" INTERFACE="eth1" USER="snort" ### Read configuration [ -r "$SYSCONFIG" ] && source "$SYSCONFIG" RETVAL=0 prog="snort" desc="Intrusion Detection System" start() { echo -n $"Starting $desc ($prog): " cd /var/log/snort daemon $prog -u $USER -g $USER -D -i $INTERFACE -l /var/log/snort -c /etc/snort/snort.conf $OPTIONS RETVAL=$? echo [ $RETVAL -eq 0 ] && touch /var/lock/subsys/$prog return $RETVAL } stop() { echo -n $"Shutting down $desc ($prog): " killproc $prog RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog return $RETVAL } restart() { stop start } reload() { echo -n $"Reloading $desc ($prog): " killproc $prog -HUP RETVAL=$? echo return $RETVAL } dump() { echo -n $"Dumping $prog database to syslog: " killproc $prog -USR1 RETVAL=$? echo return $RETVAL } case "$1" in start) start ;; stop) stop ;; restart) restart ;; reload) reload ;; condrestart) [ -e /var/lock/subsys/$prog ] && restart RETVAL=$? ;; status) status $prog RETVAL=$? ;; dump) dump ;; *) echo $"Usage: $0 {start|stop|restart|reload|condrestart|status|dump}" RETVAL=1 esac exit $RETVAL
Current thread:
- Changing the interface Vernon Webb (Dec 18)