Snort Daemon More Help Needed

[Jiju Menon <security4rrm () gmail com>]

2/24

Hello,

Thanks to Mr. Maria Lopez Hernandez for responding especially for
clearly pointing the change to me. I am not well versed in scripts.

I did as was advised. When I try to start the service it fails. Is
there anything more that I should do to get the script running on all
three interfaces?

Thank you.





----------------------------------------------------------------------------------------
HISTORY
-----------------------------------------------------------------------------------------


> Message: 7
> Date: Wed, 23 Feb 2005 17:12:47 -0500
> From: Jiju Menon <security4rrm () gmail com>
> Reply-To: Jiju Menon <security4rrm () gmail com>
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Snort Deamon
>
> IHello,
>
> I am trying to use a Snort daemon from the website
> http://msbnetworks.net/snort/snortd.txt,
>
> I am running snort on a machine with 3 interfaces and I would like to
> run snort in all interfaces.
> There is a parameter INTERFACE= , in the file. What value should I
> give if I want snort to sniff all interfaces?
>
> By default, it takes only eth0 and does not seem to change interface
> even if I specify eth1, or eth2.
>
> Any help is welcome.
>
> Thank you
>
> --__--__--
>
> Message: 8
> Subject: Re: [Snort-users] Snort Deamon
> From: Jose Maria Lopez Hernandez <jkerouac () bgsec com>
> To: "snort-users () lists sourceforge net" <snort-users () lists sourceforge net>
> Organization: bgSEC
> Date: Wed, 23 Feb 2005 23:46:52 +0100
>
> El mi=C3=A9, 23-02-2005 a las 17:12 -0500, Jiju Menon escribi=C3=B3:
> > IHello,
> > =20
> > I am trying to use a Snort daemon from the website
> > http://msbnetworks.net/snort/snortd.txt,
> > =20
> > I am running snort on a machine with 3 interfaces and I would like to
> > run snort in all interfaces.
> > There is a parameter INTERFACE=3D , in the file. What value should I
> > give if I want snort to sniff all interfaces?
>
> Just use:
> INTERFACE=3Dany
>
> But you have to change the script. What it's wrong it's the script
> you are using. It specifies the variable INTERFACE but it doesn't
> use it later to launch snort, so it won't work.
>
> Change the line:
> daemon /usr/local/bin/snort -u snort -g snort -d -D \
>                 -c /etc/snort/snort.conf
>
> to:
>
> daemon /usr/local/bin/snort -u snort -g snort -d -i $INTERFACE -D \
>                 -c /etc/snort/snort.conf
>
> and it will work.
>
> > By default, it takes only eth0 and does not seem to change interface
> > even if I specify eth1, or eth2.
> > =20
> > Any help is welcome.
> > =20
> > Thank you
>
> Regards.
>
> --=20
>
> Jose Maria Lopez Hernandez
> Director Tecnico de bgSEC
> jkerouac () bgsec com
> bgSEC Seguridad y Consultoria de Sistemas Informaticos
> http://www.bgsec.com


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users