Using snort sensors.

["Sujit Pal" <sujit.pal () verizon net>]

Hello!

I had configured a Linux system to be used as the snort sensor. This was
done as per the install recommendation shown in Snort Installation Manual by
Steven J Scott.

I ahve two NIC in this system. eth0 and eth1.
I configuer eth0 with an IP address etc.
eth1 was left alone as suggested.

I understood that the eth1 was to be used as the probe NIC and it should be
run on promiscous mode. However if I start snort with the eth1 nic card it
starts snort but do not log any data into the database.
The same works when used with the eth0 NIC.

Is my assumption that the eth1 was to be used as probe wrong. Why was it
suggested to have a second NIC if not used.

How can I put a NIC in promiscous mode and how to check that it is
promiscous mode.

I tried using ifconfig eth1 -promisc up.
I do not think that worked.

Regards.



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users