using snort without an IP Addy

["Frontgate Lab" <mdiwan () wagweb com>]

Hi all,

I am using snort with a manually defined HOME_NET and no IP Addy 
running on eth1 

I am running RH 7.1 and Snort version 1.7.1  ( the version that ships
with RedHat is 1.7.3 which segfaults.. the 1.7.1 version from
www.snort.org works quite well and is more complete.

My question is 
Why do I seem to be having no luck forcing the creation of alerts when i
nmap scan the servers on the switch where i have snort plugged in?
 It is a flat switch with no vlans.. I am trying to get IDS
notifications on any traffic on that switch. 

any help  appreciated

 my snort startup looks like this:

# Source function library.
 /etc/rc.d/init.d/functions

# Specify your network interface here
INTERFACE=eth1

# See how we were called.
case "$1" in
  start)
        echo -n "Starting snort: "
        daemon /usr/sbin/snort -u snort -g snort -s -d -D \
                -i $INTERFACE -l /var/log/snort -c /etc/snort/snort.conf
        touch /var/lock/subsys/snort


While i edited the /etc/snort/snort.conf to look like this:


var HOME_NET 21X.8X.XX.XX/24 
var EXTERNAL_NET any
var DNS_SERVERS [192.XXX.XXX.XXX/32,198.6.1.1/32]

preprocessor defrag
preprocessor http_decode: 80 8080
preprocessor portscan: $HOME_NET 4 3 /var/log/snort/portscan.log
preprocessor portscan-ignorehosts: $DNS_SERVERS


Shouldn't this work?

Thanks :)

Madhav


Note: The information contained in this message may be privileged and confidential and protected from disclosure.  If 
the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this 
message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this 
communication is strictly prohibited. If you have received this communication in error, please notify us immediately by 
replying to the message and deleting it from your computer.  Thank you.  Wagner Weber & Williams

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users