RE: Setting the nic up ??

["Walgamotte, David" <david.walgamotte () wild net>]

Similar, however the mtu is 1500. It just seems to pickup arp packets. Its
is also plugged into a switch directly connected to the internet. I started
up snort and nothing, here is the ifconfig -a

bash-2.00# ifconfig -a
lo0: flags=849<UP,LOOPBACK,RUNNING,MULTICAST> mtu 8232
        inet 127.0.0.1 netmask ff000000
hme1: flags=8c3<UP,BROADCAST,RUNNING,NOARP,MULTICAST> mtu 1500
        inet 0.0.0.0 netmask 0
        ether 8:0:20:b2:f7:e3


Here is the snort startup and summary.


---------------------------------------------------------------
Startup
-----------------------------------------------------------------

bash-2.00# /usr/local/sbin/start_snort
Log directory = /usr/local/snort/logs

Initializing Network Interface hme1

        --== Initializing Snort ==--
Decoding Ethernet on interface hme1
Initializing Preprocessors!
Initializing Plug-ins!
Initializating Output Plugins!
Parsing Rules file /usr/local/snort/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Scan alerts: ACTIVE
    Log Flushed Streams: INACTIVE
No arguments to stream4_reassemble, setting defaults:
     Reassemble client: ACTIVE
     Reassemble server: INACTIVE
     Reassemble ports: 21 23 25 53 80 143 110 111 513
     Reassembly alerts: ACTIVE
     Reassembly method: FAVOR_OLD
Back Orifice detection brute force: DISABLED
Using LOCAL time
1243 Snort rules read...
1243 Option Chains linked into 152 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Rule application order: ->activation->dynamic->alert->pass->log

        --== Initialization Complete ==--

-*> Snort! <*-
Version 1.8.6 (Build 105)
By Martin Roesch (roesch () sourcefire com, www.snort.org)





----------------------------------------------------------------------------
-----------
Summary after crtl c
----------------------------------------------------------------------------
------------
============================================================================
===
Snort analyzed 16 out of 16 packets, The kernel dropped 0(0.000%) packets

Breakdown by protocol:                Action Stats:
    TCP: 0          (0.000%)          ALERTS: 0
    UDP: 0          (0.000%)          LOGGED: 0
   ICMP: 0          (0.000%)          PASSED: 0
    ARP: 16         (100.000%)
   IPv6: 0          (0.000%)
    IPX: 0          (0.000%)
  OTHER: 0          (0.000%)
DISCARD: 0          (0.000%)
============================================================================
===
Fragmentation Stats:
Fragmented IP Packets: 0          (0.000%)
    Fragment Trackers: 0
   Rebuilt IP Packets: 0
   Frag elements used: 0
Discarded(incomplete): 0
   Discarded(timeout): 0
  Frag2 memory faults: 0
============================================================================
===
TCP Stream Reassembly Stats:
        TCP Packets Used: 0          (0.000%)
         Stream Trackers: 0
          Stream flushes: 0
           Segments used: 0
   Stream4 Memory Faults: 0
============================================================================
===
Snort received signal 2, exiting


Thanks Dave



-----Original Message-----
From: D W [mailto:esecure1 () yahoo com] 
Sent: Monday, June 10, 2002 4:49 PM
To: Walgamotte, David; 'snort-users () lists sourceforge net'
Subject: Re: [Snort-users] Setting the nic up ??


David,

This should do the trick for you.....

ifconfig <interface> plumb -arp

Use the command, ifconfig -a to see if the card is
working properly. You should see an output similar to
this:

Flags=8c3<UP, BROADCAST, RUNNING, NOARP, MULTICAST>

mtu 4352

inet 0.0.0.0 netmask 0

ether 8:0:20:f0:0:ba

--- "Walgamotte, David" <david.walgamotte () wild net>
wrote:
> Anyone know how to put a nic in promiscuous mode
> without an ip in
> solaris.
>  
> David


__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com