Snort mailing list archives
interface on promiscuous mode ?
From: Ashley Thomas <athomas () unity ncsu edu>
Date: Fri, 22 Mar 2002 14:10:46 -0500 (EST)
hi, i am setting up snort on a linux machine and needs the ethernet interface to be in stealth mode. so i did a simple "ifconfig eth0 up" and see the ifconfig -a as: eth1 Link encap:Ethernet HWaddr 00:03:86:45:BB:77 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1029434 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 Interrupt:5 Memory:f9000000-f9020000 But i see only arp and broadcast packets when i do a tcpdump -i eth1 Looking at /var/log/messages, i don't see "device eth1 entered promiscuous mode" Is this the problem ? How do i make it go into promiscuous mode ? thanks _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- interface on promiscuous mode ? Ashley Thomas (Mar 22)
- <Possible follow-ups>
- RE: interface on promiscuous mode ? Wirth, Jeff (Mar 22)
- RE: interface on promiscuous mode ? Slighter, Tim (Mar 22)
- Re: interface on promiscuous mode ? Mike_Sands (Mar 22)
- RE: interface on promiscuous mode ? Sean T. Ballard (Mar 22)