Snort mailing list archives
Re: Snort Deamon
From: Jose Maria Lopez Hernandez <jkerouac () bgsec com>
Date: Wed, 23 Feb 2005 23:46:52 +0100
El mié, 23-02-2005 a las 17:12 -0500, Jiju Menon escribió:
IHello, I am trying to use a Snort daemon from the website http://msbnetworks.net/snort/snortd.txt, I am running snort on a machine with 3 interfaces and I would like to run snort in all interfaces. There is a parameter INTERFACE= , in the file. What value should I give if I want snort to sniff all interfaces?
Just use: INTERFACE=any But you have to change the script. What it's wrong it's the script you are using. It specifies the variable INTERFACE but it doesn't use it later to launch snort, so it won't work. Change the line: daemon /usr/local/bin/snort -u snort -g snort -d -D \ -c /etc/snort/snort.conf to: daemon /usr/local/bin/snort -u snort -g snort -d -i $INTERFACE -D \ -c /etc/snort/snort.conf and it will work.
By default, it takes only eth0 and does not seem to change interface even if I specify eth1, or eth2. Any help is welcome. Thank you
Regards. -- Jose Maria Lopez Hernandez Director Tecnico de bgSEC jkerouac () bgsec com bgSEC Seguridad y Consultoria de Sistemas Informaticos http://www.bgsec.com ESPAÑA The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. -- Jack Kerouac, "On the Road" ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_ide95&alloc_id396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort Deamon Jiju Menon (Feb 23)
- Re: Snort Deamon Jose Maria Lopez Hernandez (Feb 23)