Re: Mode promiscius

["Shane M. Addison via Snort-users" <snort-users () lists snort org>]

Here are instructions for changing the setting in ESXi.

https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004099

You will want to have a dedicated NIC for this. 

Shane Addison
VP, IT Security & Process Improvement Officer
First Mid-Illinois Bank & Trust
1421 Charleston Ave., Mattoon, IL  61938
217-258-1530
www.firstmid.com 

-----Original Message-----
From: wkitty42 () windstream net [mailto:wkitty42 () windstream net] 
Sent: Friday, July 28, 2017 9:54 AM
To: snort-users () lists snort org
Subject: Re: [Snort-users] Mode promiscius

On 07/28/2017 09:22 AM, Rashid CORIA wrote:
> I’m installing Snort in a esxi virtual machine, is it necessary to 
> activate the « mode promiscius » ?

yes... without it, snort cannot see *all* traffic... it would see only traffic to its IP but for snort to do its 
designed job, it needs to see all traffic...

> Do you have any procedure how and where to activate it ?

i do not know...

> Will i face any issues with the other VM installed in my esx ?

??


--
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list unless*
        *a signed and pre-paid contract is in effect with us.* _______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!




-------------------------------------------------------------------------
This message was secured by ZixCorp(R).
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!