RE: Snort with 2 eth

["Schmehl, Paul L" <pauls () utdallas edu>]

# ifconfig eth0 -promisc

This will put the card in promiscuous mode.

To make it work on reboots you need to edit
/etc/sysconfig/network-scripts/ifcfg-eth0:

DEVICE=eth0
ONBOOT=yes
USERCTL=no
BOOTPROTO=none
PROMISC=yes

See /usr/share/doc/initscripts-x.xx/sysconfig.txt

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/~pauls/
AVIEN Founding Member 


-----Original Message-----
From: David Alonso De La Vega Tapage [mailto:delavegad () bancoaliado com] 
Sent: Monday, February 10, 2003 2:49 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Snort with 2 eth


Hi for all again ..

I'm not sure maybe do something wrong, but in my RH box when run snort 
-c /etc/snort/snort.conf  asume the eth1 as the right nic ..  

my eth1 is my internal nic ..  and eth0 is the sniffing nic and no have 
ip ..  stay up ..  but cant run snort with it ..

What I need to configure, to snort use my eth0  to snort .. ?

in snort.conf have ethaddress parameter ...  but as my eth0 not have IP 
don't need to configure ntohing here right?

well thanx for all suggestions .. and links .. !

Thanx in advance ..

David Alonso



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users