Re: using snort without an IP Addy

[Dr SuSE <drsuse () drsuse org>]

Did you run ifconfig eth1 up before starting snort?

> When you type 'ifconfig' do you get info for eth1?  Red Hat doesn't bring
> up the second interface on boot unless you tell it to.
>
> cat /etc/sysconfig/network-scripts/ifcfg-eth1
>
> and verify that ONBOOT is set to 'yes'
>
> if the file doesn't exist, create it with something similar to the
> following:
>
> <snip>
> DEVICE=eth1
> BOOTPROTO=static
> BROADCAST=192.168.1.255
> IPADDR=192.168.1.10
> NETMASK=255.255.255.0
> NETWORK=192.168.1.0
> ONBOOT=yes
> </snip>
>
> Hope this helps.
>
> Blake 
>
> ================================================================= 
> The Government, like diapers, should be replaced regularly, and
> often for the same reasons. 
>
> On Mon, 2 Jul 2001, Frontgate Lab wrote:
>
> > Hi all,
> >
> > I am using snort with a manually defined HOME_NET and no IP Addy 
> > running on eth1 
> >
> > I am running RH 7.1 and Snort version 1.7.1  ( the version that ships
> > with RedHat is 1.7.3 which segfaults.. the 1.7.1 version from
> > www.snort.org works quite well and is more complete.
> >
> > My question is 
> > Why do I seem to be having no luck forcing the creation of alerts when i
> > nmap scan the servers on the switch where i have snort plugged in?
> >  It is a flat switch with no vlans.. I am trying to get IDS
> > notifications on any traffic on that switch. 
> >
> > any help  appreciated
> >
> >  my snort startup looks like this:
> >
> > # Source function library.
> >  /etc/rc.d/init.d/functions
> >
> > # Specify your network interface here
> > INTERFACE=eth1
> >
> > # See how we were called.
> > case "$1" in
> >   start)
> >     echo -n "Starting snort: "
> >     daemon /usr/sbin/snort -u snort -g snort -s -d -D \
> >             -i $INTERFACE -l /var/log/snort -c /etc/snort/snort.conf
> >     touch /var/lock/subsys/snort
> >
> >
> > While i edited the /etc/snort/snort.conf to look like this:
> >
> >
> > var HOME_NET 21X.8X.XX.XX/24 
> > var EXTERNAL_NET any
> > var DNS_SERVERS [192.XXX.XXX.XXX/32,198.6.1.1/32]
> >
> > preprocessor defrag
> > preprocessor http_decode: 80 8080
> > preprocessor portscan: $HOME_NET 4 3 /var/log/snort/portscan.log
> > preprocessor portscan-ignorehosts: $DNS_SERVERS
> >
> >
> > Shouldn't this work?
> >
> > Thanks :)
> >
> > Madhav
> >
> >
> > Note: The information contained in this message may be privileged and 
confidential and
protected from disclosure.  If the reader of this message is not the intended 
recipient,
or an employee or agent responsible for delivering this message to the intended 
recipient,
you are hereby notified that any dissemination, distribution or copying of this
communication is
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


Score my PGP key @
http://www.drsuse.org/pks

---------------------------------------------
Microsoft ist nicht installiert.
http://www.drsuse.org/



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users