Re: Promiscuouls Mode Question

[Jim Kipp <jkipp5 () home com>]

> Seriously, look at the traffic.  Is it only traffic bound for your IP?  If so,
> you're seeing what you should be when not in promisc mode.  If that's the
> case, then yes, it's all working as it should.

that seems OK.

> Try doing a 'tcpdump not host <foo>' with <foo> being your host.  If you see
> traffic to/from other boxes other than ARP, then there is something kinda odd
> going on.

I tried this and I saw alot of arp request traffice from all sorts of
hosts not on my network. I did this with no activity on my LAN. 

> Hope this helps!

Yes, it does. Thanks
Jim

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users