Re: snort1.8p + dynamic ip address

[Sten "\"s10\"" at Home <sten () ipjam com>]

Hi Marcus,

You can run periodically (from crontab) a script and check if your
IP has changed.

Here is a script snippet you can use as a sample.


cd /home/snort
current_ip=`/sbin/ifconfig $EXT_NIC |sed -n -e "s/^[ ]*inet
addr\:\([0-9.]*\).*$/\1/p"`

if ! [ -e "savedsnortip" ]; then
    printf "$current_ip" > savedsnortip
    old_ip=$current_ip
else
    old_ip=`cat savedsnortip`
fi
if ! [ "$current_ip" = "$savedsnortip" ] ; then
   /etc/rc.d/initd/snort restart
fi

Yes, you have also to change the snort startup script
in orderr to) generate the 
savesnortip file .

grtz,
Sten Kalenda

Marcus Henschel wrote:
> Hi all,
>
> i am using snort (1.8p) on my dsl gateway. the dsl-line is interrupted
> exactly after 24 hours and then the ppp software connects automaticly to my
> provider and i get a new ip-address. my problem is, if the line is
> disconnected, the snort deamon  does not run anymore.
>
> I start snort with the following command: "./snort -c ../etc/snort.conf -i
> tun0 -D"
>
> Any suggestions ?
>
> regards
>
> marcus
>
> --
>
> Marcus Henschel         mail: marcus[at]hamburg.de
> 20357 Hamburg
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 

=- To spoof or not to spoof, that is the packet -=

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users