Re: Troubles With Multiple Sensors

["Shawn Truax" <Shawn.Truax () mbs gov on ca>]

I would suggest trying tcpdump instead of snort to do your testing.  Running tcpdump as follows:

tcpdump -n -X -i eth1

Should dump all packets received on that uplink port and display their payloads (Drop the -X if you don't want 
payload).  This should give you everything ARP, broadcast and anything destined to the port without the complications 
that snort may give.  As an aside I find tcpdump to be the best tool for testing/diagnosing an interface before running 
snort to make sure everything is working properly.

Shawn

> > > "Tim Rohrer" <snort () metbymail com> 10/23/03 09:03am >>>
All,

I am looking for more help as I continue to learn this thing : )

I have added a second NIC to the computer I am using for snort and 
have connected it to the shared uplink port on my switch (I am trying 
to confirm with the manufacturer that this port gets broadcasted 
traffic).  I gave the NIC an IP address not on my home network.  To 
test, I issued the command:

snort -v -i eth1 but I am not getting anything at all.

Do I need to be doing something different to test a second sensor? 
Is the fact that I am not detecting any traffic a good sign that the 
uplink port IS NOT doing what I hoped?

I had tried placing an inexpensive 10M hub between my cable modem and 
the router but the cable modem would not pass any traffic to the hub. 
: (

Thanks in advance for any help.

Tim
-- 
Tim Rohrer
tgrohrer () metbymail com
http://www.metbymail.com


-------------------------------------------------------
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is doing for the Open
Source Community?  Make a contribution, and help us add new
features and functionality. Click here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users