Snort mailing list archives

Snort Solaris 8 with quad card


From: Chris Frazier - PA <Chris_Frazier () GMACM COM>
Date: Tue, 2 Apr 2002 13:35:00 -0500

Greetings,
I have Snort running on a Ultra 5 with Solaris 8.  I bring up interfaces
qfe2 and qfe3 without IP addresses being assigned on differnet VLANs, and
have Snort listen on those interfaces using separate commands:

snort -D -c conf.file -l /var/log/snort/qfe2 -i qfe2
snort -D -c conf.file -l /var/log/snort/qfe3 -i qfe3

When I trigger scans on those VLANs, qfe2 logs the results, but qfe3 does
nothing.  If I kill the snort running on qfe3, and just do a tcpdump -i
qfe3, and run tthe scans again, I see the traffic.

So am I doing something completely wrong, or am I trying to do something
that is not possible.

Any help is greatly appreciated.

Thanks
Chris


Current thread: