Re: Problem running in daemon mode

[Chris Green <cmg () sourcefire com>]

Dany Allard <dallard () alterna com> writes:

> Hello
>
>   I am having a problem, that when I run Snort with the -D flag the card
> is not running in PROMISC mode.
>
>   I can run snort with from the command line using
>    ./snort -b -c /etc/snort/snort.conf -h xxx.xxx.xxx.0/24 -i eth1
> and everything runs fine and if I run ifconfig the card shows as " UP
> BROADCAST RUNNING PROMISC MULTICAST "
> when I run the following
>         /usr/local/bin/snort -D -b -c /etc/snort/snort.conf -h
> xxx.xxx.xxx.0/24 -i eth1
>  I don't see any traffic in the logs and if I run ifconfig the card
> shows as "UP BROADCAST RUNNING MULTICAST".
>
> Has anyone seen this problem before (I saw similar problems going back
> through the snort-users mailing list but nothing that fixed my problem).

What does ifconfig show when you have no snort running?

Sometimes it gets confused and leaves the interface in promiscious
mode and there is only a toggle switch IIRC on the pcap open so it
will alter it back to non-promisc.


-- 
Chris Green <cmg () sourcefire com>
"Yeah, but you're taking the universe out of context."


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users