RE: promiscuous mode on linux

["Moyer, Shawn" <SMoyer () rgare com>]

Maybe you should try Linux on Intel or one of the BSD's?

Seriously, you're hitting pretty uncharted territory with this on a 9K.
People are successfully running Snort on most Linuces, *BSD, AIX, and
Slowlaris, but there's probably a handful of people (at best) doing anything
with Snort on HP, and you may be the only person on the planet running it on
Debian on HP. :) 

Here's some googling of the list for Snort on HP:

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=HP-UX+HP%2FUX+
group%3Amailing.unix.snort

Hate to waste that 9K, though... Howzabout running the DB / web server /
Acid on it, and using an x86 box for the sensor? Should crank it out pretty
good with that setup.





--shawn


> -----Original Message-----
> From: Chris Green [mailto:cmg () sourcefire com]
> Sent: Thursday, August 08, 2002 13:16
> To: Know How
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] promiscuous mode on linux
>
>
> "Know How" <beteachable () hotmail com> writes:
>
> > Hi all,
> >     sorry i missed mentioning about hardware, i am running it on
> >     HP9000-A500. Also it should be eth0 not lan0.
> >     I disabled frag2/stream4 and i still get the same message on the
> >     console and no intrusion logging happens, and i wont 
> see anything
> >     logged into /var/log/snort/alert or portscan.log
> >
> > Thanks again.
>
> Sorry, the HP platform is a developer pariah currently. Unless someone
> steps up and helps fix it, I can't do anything.  Try 1.9beta2 to see
> if the elimination of bitwise accesses help you but I Don't think
> there's a snowball of a chance of getting it working on the HP without
> an as of yet unfound developer stepping up.
>
> HP-UX is hard enough to get working there.  Linux/HP is prolly even
> more rare :)
> -- 
> Chris Green <cmg () sourcefire com>
> I've had a perfectly wonderful evening. But this wasn't it.
>      -- Groucho Marx
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users