Snort mailing list archives
Re: Problem running in daemon mode
From: Dany Allard <dallard () alterna com>
Date: Thu, 14 Mar 2002 13:15:30 -0700
ifconfig shows that the card is "UP BROADCAST RUNNING MULTICAST" when snort is stopped. I also upgraded my libpcap to version v0.6.2 and I still have the same problem. Any guesses? Chris Green wrote:
Dany Allard <dallard () alterna com> writes:Hello I am having a problem, that when I run Snort with the -D flag the card is not running in PROMISC mode. I can run snort with from the command line using ./snort -b -c /etc/snort/snort.conf -h xxx.xxx.xxx.0/24 -i eth1 and everything runs fine and if I run ifconfig the card shows as " UP BROADCAST RUNNING PROMISC MULTICAST " when I run the following /usr/local/bin/snort -D -b -c /etc/snort/snort.conf -h xxx.xxx.xxx.0/24 -i eth1 I don't see any traffic in the logs and if I run ifconfig the card shows as "UP BROADCAST RUNNING MULTICAST".What does ifconfig show when you have no snort running? Sometimes it gets confused and leaves the interface in promiscious mode and there is only a toggle switch IIRC on the pcap open so it will alter it back to non-promisc.
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Problem running in daemon mode Dany Allard (Mar 12)
- Re: Problem running in daemon mode Chris Green (Mar 12)
- Re: Problem running in daemon mode Dany Allard (Mar 14)
- Re: Problem running in daemon mode Leigh David Heyman (Mar 14)
- Re: Problem running in daemon mode Dany Allard (Mar 15)
- Re: Problem running in daemon mode Dany Allard (Mar 14)
- Re: Problem running in daemon mode Chris Green (Mar 12)