Re: capturing on the wrong nic

[Russ Combs <rcombs () sourcefire com>]

On Mon, Oct 18, 2010 at 8:56 PM, Chris Copeland <roninuta () gmail com> wrote:

>  I used the following guide:
>
> http://it.thelibrarie.com/weblog/2010/06/installing-snort-on-ubuntu-10-04/
>
>  but when I was testing to start snort I used the command: snort -c
>  /etc/snort/snort.conf -i eth1

Do you see the traffic you want when you run snort -devi eth1 or with snort
-devi eth0?

>  did I miss something?
>
> > On Mon, Oct 18, 2010 at 7:48 PM, Joel Esler <jesler () sourcefire com>
> wrote:
> > > You can specify the interface that Snort is listening on by using the -i
> command line tag.
> > > like snort -i eth0 or snort -i eth1.
> > >
> > > Joel
> > >
> > > On Oct 18, 2010, at 8:41 PM, Chris Copeland wrote:
> > >
> > > > Yep, total newbie here, but I have managed to do the following:
> > > > install LAMP, install snort, configure 2 eth devices, install base,
> > > > and capture traffic, the only problem is that it is traffic on the
> > > > management nic, not the nic I have plugged in to my hub (the one I
> > > > want sniffing).
> > > >
> > > > topology:
> > > > cable modem
> > > > -> hub -> snortTest
> > > > -> hub -> firewall/wireless router -> home network devices
> > > >
> > > > I know this has to be a setting in the conf file, at least I think it
> does.
> > > > My internal IP: 10.0.1.15
> > > > from the snort.conf:
> > > > var HOME_NET 10.0.1.0/24
> > > > var EXTERNAL_NET any
> > > >
> > > > eth0 - management nic
> > > > eth1 - sniffer nic
> > > >
> > > > what am I doing wrong?
> > > >
> > > > Thanks in advance!!!
> ------------------------------------------------------------------------------
> > > > Download new Adobe(R) Flash(R) Builder(TM) 4
> > > > The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly
> > > > Flex(R) Builder(TM)) enable the development of rich applications that
> run
> > > > across multiple browsers and platforms. Download your free trials
> today!
> > > > http://p.sf.net/sfu/adobe-dev2dev
> > > > _______________________________________________
> > > > Snort-users mailing list
> > > > Snort-users () lists sourceforge net
> > > > Go to this URL to change user options or unsubscribe:
> > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > Snort-users list archive:
> > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > >
> > > --
> > > Joel Esler
> > > 302-223-5974
>
> --
> Chris Copeland
> clcopeland () pluto dsu edu
> chris () chriscopeland com
> 817.791.6728 cell
> KF5BND
>
>
> ------------------------------------------------------------------------------
> Download new Adobe(R) Flash(R) Builder(TM) 4
> The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly
> Flex(R) Builder(TM)) enable the development of rich applications that run
> across multiple browsers and platforms. Download your free trials today!
> http://p.sf.net/sfu/adobe-dev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
Download new Adobe(R) Flash(R) Builder(TM) 4
The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly 
Flex(R) Builder(TM)) enable the development of rich applications that run
across multiple browsers and platforms. Download your free trials today!
http://p.sf.net/sfu/adobe-dev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users