Snort mailing list archives

Re: Run as user?


From: Joe Hill <joehill () sympatico ca>
Date: Thu, 3 Apr 2003 02:00:55 -0500

On Thu, 3 Apr 2003 01:03:03 -0500 (EST)
Alberto Gonzalez <albertg () wwjh net> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1




sorry, what I meant was to actually run snort without first su'ing to root.

is there any way to do this and have access to eth0?


search google, I believe there is a kernel module[1] out there that will 
allow a non-privileged user to set eth0 into promisc mode.

I just want to use this for learning, it would be nice to just go "Eterm -e snort blah blah blah"

as to /var/log/snort you will need to make the directory yourself. 

already done and it looks like we are up and running. Now to figure out what all that mumbo-jumbo scrolling across my 
term means...I recall seeing something in snort.conf about a simpler output...

anyway, thanks for the help and info!

 Cheers,
 Alberto Gonzalez

[1] - sorry, i don't remember the name.... but i will check for ya.

- -- 
"Success comes to the person who does today, what you are thinking of doing tomorrow." 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+i86ca3vAB/3yp/IRAhZDAJ0cZBvxcbcrA7tNxSytuxijk0gg1ACfRLhb
+SoYqoeW4QTy63MdN7CLIto=
=hn8N
-----END PGP SIGNATURE-----


-- 






-------------------------------------------------------
This SF.net email is sponsored by: ValueWeb: 
Dedicated Hosting for just $79/mo with 500 GB of bandwidth! 
No other company gives more support or power for your dedicated server
http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: