Snort mailing list archives

Bonding interfaces on Suse 9


From: Glenn Conant <gconant () charter net>
Date: Wed, 29 Dec 2004 12:12:00 -0500

I seem to be having an issue trying to get bonding working on Suse 9. I have built a passive tap thanks to the diagram by Micheal Peters on the snort.org home page and set up 3 interfaces. Eth0 for management and eth1 and eth2 to act as slave interfaces. I have set up eth1 and 2 and bond0 without IPs and can only seem to get one side of the traffic when bonded. I can run tcpdump and see traffic from eth1 and eth2 independantly but not when bonded. Any ideas?

Since I don't have a span port option I'de really like snort to see both sides of the traffic from bond0 so I don't have to run multiple instances of snort. Not sure if I can run 2 instances and actuall y get good info that way. Any help would be appreciated.

-Glenn



-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: