Problem: Snort Daemon - again -:(

[Jiju Menon <security4rrm () gmail com>]

2/28

I am running snort from command line in my Redhat 9 gateway machine
that has 3 interfaces.

I had received some responses on this issue to my earlier mails. But
the snort daemon that I implemented using INTERFACE=any DOES NOT seem
to detect traffic on all interfaces in the machine I want it to be
working.

Mr. Maria Lopez Hernandez asked me to put INTERFACE=3Dany where I
received the error

Feb 26 15:22:07 Gateway modprobe: modprobe: Can't locate module 3Dany
Feb 26 15:22:07 Gateway snort: FATAL ERROR: OpenPcap() device 3Dany
open:  ^Iioctl: No such device
Feb 26 15:22:07 Gateway snortd: snort startup failed

Is there a possible cure for this?


Thanks.




> ----------------------------------------------------------------------------------------
> HISTORY
> -----------------------------------------------------------------------------------------

Solution from Mr. Maria Lopez Hernandez

> > Just use:
> > INTERFACE=3Dany
> >
> > But you have to change the script. What it's wrong it's the script
> > you are using. It specifies the variable INTERFACE but it doesn't
> > use it later to launch snort, so it won't work.
> >
> > Change the line:
> > daemon /usr/local/bin/snort -u snort -g snort -d -D \
> >                 -c /etc/snort/snort.conf
> >
> > to:
> >
> > daemon /usr/local/bin/snort -u snort -g snort -d -i $INTERFACE -D \
> >                 -c /etc/snort/snort.conf
> >
> > and it will work.
> >
> > > By default, it takes only eth0 and does not seem to change interface
> > > even if I specify eth1, or eth2.
> > > =20
> > > Any help is welcome.
> > > =20
> > > Thank you
> >
> > Regards.
> >
> > --=20
> >
> > Jose Maria Lopez Hernandez
> > Director Tecnico de bgSEC
> > jkerouac () bgsec com
> > bgSEC Seguridad y Consultoria de Sistemas Informaticos
> > http://www.bgsec.com


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users