Snort mailing list archives
Re: Snort will not detect anything on stealth interface unless I assign IP
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Mon, 19 Jul 2004 11:27:00 +1200
On Sat, Jul 17, 2004 at 12:10:25PM -0700, Rhugga wrote:
I have attached 1 interface of from ISD box a hub containing our border router and our 2 firewalls. I bring the interface up with no IP address and snort will not start due to $eth1_ADDRESS being null.
Well that's not right. I've run snort from RH7 to Fedora Core2 and it doesn't need an IP address. However, the interface has to be UP. Make sure your /etc/sysconfig/network-scripts/ifcfg-ethX looks like this: DEVICE=eth1 ONBOOT=yes BOOTPROTO=static IPADDR=0.0.0.0 NETMASK=0.0.0.0 Change ethX appropriately.
snort will start when eth1 has this dummy IP address but no rules are getting detected.
What does tcpdump on that interface show? If it can't see traffic, then neither can snort. Actually "snort -v -i ethX" should do the same.
When I put a valid IP address on that interface in the same net as the router and firewalls, snort then starts matching rules...
Err... Now you're just getting freaky :-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort will not detect anything on stealth interface unless I assign IP Rhugga (Jul 17)
- Re: Snort will not detect anything on stealth interface unless I assign IP Paul Schmehl (Jul 17)
- Re: Snort will not detect anything on stealth interface unless I assign IP Matt Kettler (Jul 17)
- Re: Snort will not detect anything on stealth interface unless I assign IP Rhugga (Jul 19)
- Re: Snort will not detect anything on stealth interface unless I assign IP Paul Schmehl (Jul 19)
- Re: Snort will not detect anything on stealth Matt Kettler (Jul 19)
- Re: Snort will not detect anything on stealth interface unless I assign IP Rhugga (Jul 19)
- Re: Snort will not detect anything on stealth interface unless I assign IP Jason Haar (Jul 18)
- Re: Snort will not detect anything on stealth interface unless I assign IP Rhugga (Jul 19)
- Re: Snort will not detect anything on stealth interface unless I assign IP Edin Dizdarevic (Jul 19)