RE: Snort on Linux Help

[David Wilkeson <davelist () cboss com>]

I agree. I just installed Ethereal and it sees exactly the same thing as 
Snort does, so it isn't Snort.

I have plugged my Windows machine running Snort into the exact port that 
the Linux box is plugged into and it sees everything, so it definitely has 
something to do with the Linux box.  I haven't had any errors compiling 
various versions of libpcap, nor installing the RPMs.  Additionally the 
syslog indicates that the interface is going in and out of promiscuous mode 
when I start and stop Snort.

Dave

At 03:44 PM 11/21/2001 -0600, you wrote:
> The fact that you're only seeing broadcast traffic would lend itself to
> suggest you are not actually monitoring that port like you think you
> are.  Have you run tcpdump to verify you're seeing all traffic you're
> supposed to, or are you only seeing broadcasts as well?
>
> I would imagine that if libpcap had a problem, it would either not
> compile or would generate bizarre errors when snort was compiled....
>
>
>
> -----Original Message-----
> From: David Wilkeson [mailto:davelist () cboss com]
> Sent: Wednesday, November 21, 2001 2:14 PM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Snort on Linux Help
>
>
> I've been running Snort on a Windows platform on and off for some time
> so I
> am fairly well versed in Snort itself.  I recently decided to set up a
> permanent Snort box, and decided that Linux would be better suited for
> this
> application.  Well, I've got everything set up and running and I am
> testing
> by having Snort log everything, but I can't get Snort to see anything
> with
> a destination address other than an Ethernet broadcast address (.255),
> the
> box itself, or any machine that is connecting directly to the linux
> box.  It's not a physical Ethernet problem as it works fine when I plug
> my
> Windows Snort box into that jack on my switch (I have monitoring mode
> turned on for that switch port).  I think it must be a problem with
> libpcap, but I have uninstalled and reinstalled various versions and
> packages including RPMs and source code.  I've made sure that IPCHAINS
> is
> disabled.  I am completely out of ideas and my head hurts from beating
> it
> repeatedly against the wall.  Anyone else have any thoughts?
>
> TIA!
> Dave
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users