Should I setup NIC sensor with IP address or without IP address ?

[Marcio Guerreiro <marcio.guerreiro () hotmail co uk>]

Hello all

 

I am having problems to generate alerts and I think it might be related to
my network card configuration:

 

I read that the network card in promiscuous mode should not have IP address.
However when I follow the instructions to setup the interface as 0.0.0.0,  I
cannot generate any type of alerts. 

On the other hand when I add an IP address I manage to generate TWO types of
alerts using the following rules:

 



 

The alerts are show here. it captures the ping ICMP and the TCP packets from
my SSH session

 



 

 

But if I try to generate alerts using the following rule it does not work.

 



 

Or this other rule does not work either.

 



 

 

I was wondering if the problem is related to my network configuration.  

My network setup is. 

The Generic Receive Offload is off, but LRO (Cannot change
large-receive-offload) I assume that my network card does not support this
feature.

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!