RE: Libpcap and 'ip-address-less' interfaces...

[Michael Aylor <maylor () swbanktx com>]

Peter,

I also run ip-addressless snort, and it also gives the same warning, but it
doesn't bomb.  Is it failing, or just complaining?

Also, am currently running 0.6.2 libpcap.


Mike

-----Original Message-----
From: Peter Bates [mailto:Peter.Bates () lshtm ac uk]
Sent: Wednesday, December 05, 2001 8:18 AM
To: snort-users
Subject: [Snort-users] Libpcap and 'ip-address-less' interfaces...



Hello all...

I've been running snort (currently 1.8.2)
for nearly a year or so now without complaint,
and only the odd confused moment (on my part!)...

I updated recently to a RedHat packaged
(this is all running on a hacked-around RH 7.1)
version of libpcap-0.6.2, and have seen the following:

WARNING: OpenPcap() device eth1 network lookup:  ^Ieth1: no IPv4
address assigned

As you might guess, eth1 is my 'snorting' interface, brought up (as per
the FAQ and many discussions here) with just ifconfig eth1 up.

Snort here doesn't complain, but many other little apps I'm trying to
try that rely on libpcap bomb out because of the lack of IP address.

Will sticking a non-routable private IP address on this interface
(which faces the 'outside' world) be OK, if it remains promiscuous,
or should I be complaining to the authors of these apps to make them
behave like Snort, and complain about the lack of IP address, but
carry on regardless?

Hope this makes some sort of sense...




----------------------------------------------------------------------------
---------------------------------------->
Peter Bates, Systems Support Officer, Network Support Team.
London School of Hygiene & Tropical Medicine.
Telephone:0207-927 2124 / Fax: 0207- 636 9838 

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


CONFIDENTIALITY NOTICE:

************************************************************************

The information contained in this ELECTRONIC MAIL transmission
is confidential.  It may also be privileged work product or proprietary
information. This information is intended for the exclusive use of the
addressee(s).  If you are not the intended recipient, you are hereby
notified that any use, disclosure, dissemination, distribution [other
than to the addressee(s)], copying or taking of any action because
of this information is strictly prohibited.

************************************************************************