Re: starting snort

[Edin Dizdarevic <edin.dizdarevic () interActive-Systems de>]

Hi,

unfortunatelly you wrote nothing about your network setup. If all the
traffic you want to observe is going over your sensor, no need to run
the nics in the promisc mode. Otherwise you even have to, but please
read the docs and older posts about running Snort on a switch or a hub.
There is a small caveat outhere.

Regards,
Edin

Juan Fernandez wrote:

> Hi
>
>
>
> I have a question starting snort,
>
>
>
> I have 2 nics they are eth1 and eth2 I want that etc1 will be in
> promisc mode.
>
>
>
> Now I read that to start snort I need to insert the following
> command:
>
>
>
> Usr/local/snort/bin/snort -c /usr/local/snort/conf/snort.conf -l -I
> eth1 -u snort_user -g snort_group
>
>
>
> Do I really need to insert the eth1 or eth2 ? I mean do I need to put
> the promisc mode there or the other nic ?
>
>
>
> Thanks

--
Edin Dizdarevic


-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users