Snort mailing list archives
Re: Problem with ethercard and promiscuous mode
From: Jim Patterson <jim_patterson () comcast net>
Date: Wed, 31 Mar 2004 08:54:09 -0600
Sorry it took so long to get back. The cards are listed as 3Com Corporation 3c905C-TX/TX-M [Tornado] (rev 78) 3Com Corporation 3c905C-TX/TX-M [Tornado] (rev 74)I'm not sure which one is the culprit, but I am going to guess that rev 74 is . If someone knows how I could translate the information between lspci output and ifconfig. I'd appreciate the info.
Josh Berry wrote:
What kind of network cards are you using? I have had this same problem with some 3Com cards.On my snort system I have two ethernet cards and was attempting to monitor both outside of the firewall and inside of the firewall. When I monitor with eth0 I don't have a problem, but eth1 appears to refuse to go into promiscuous mode. I have run "ifconfig eth1 promisc up" and it doesn't seem to have any affect except on ifconfig which returns that it is in PROMISC. I test it by running tcpdump and seeing if I can see traffic on a hub, but with the card in eth1 it doesn't appear to work. if I switch and use the card designated eth0 , connected with the same cable, then I can see the traffic. I believe that the testing has ruled out the hub or the cable being the problem. Both cards are the same, just one of them appears not to be able to go into promiscuous mode. Anyboy ran into a problem like this? Any possible solutions? Is it really possible that I have a bad card and it won't go into promiscuous mode? ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-usersThanks, Josh Berry, CISSP CTO, VP of Product Development LinkNet-Solutions 469-831-8543 josh.berry () linknet-solutions com ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Problem with ethercard and promiscuous mode Jim Patterson (Mar 29)
- Re: Problem with ethercard and promiscuous mode Josh Berry (Mar 30)
- Re: Problem with ethercard and promiscuous mode Jim Patterson (Mar 31)
- Re: Problem with ethercard and promiscuous mode Josh Berry (Mar 30)