Snort mailing list archives
Changing the interface
From: "Vernon Webb" <vernon () comp-wiz com>
Date: Sat, 18 Dec 2004 19:30:39 -0500
How do I change the interface for logging on SNORT? In the startup script I have changed the INTERFACE to eth1 however
it is still logging from eth0, what's up with that? Here's what my start up script says now:
source /etc/rc.d/init.d/functions
source /etc/sysconfig/network
### Check that networking is up.
[ "${NETWORKING}" == "no" ] && exit 0
[ -x /usr/sbin/snort ] || exit 1
[ -r /etc/snort/snort.conf ] || exit 1
### Default variables
SYSCONFIG="/etc/sysconfig/snort"
OPTIONS="-s -d"
INTERFACE="eth1"
USER="snort"
### Read configuration
[ -r "$SYSCONFIG" ] && source "$SYSCONFIG"
RETVAL=0
prog="snort"
desc="Intrusion Detection System"
start() {
echo -n $"Starting $desc ($prog): "
cd /var/log/snort
daemon $prog -u $USER -g $USER -D -i $INTERFACE -l /var/log/snort -c /etc/snort/snort.conf $OPTIONS
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/$prog
return $RETVAL
}
stop() {
echo -n $"Shutting down $desc ($prog): "
killproc $prog
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog
return $RETVAL
}
restart() {
stop
start
}
reload() {
echo -n $"Reloading $desc ($prog): "
killproc $prog -HUP
RETVAL=$?
echo
return $RETVAL
}
dump() {
echo -n $"Dumping $prog database to syslog: "
killproc $prog -USR1
RETVAL=$?
echo
return $RETVAL
}
case "$1" in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
reload)
reload
;;
condrestart)
[ -e /var/lock/subsys/$prog ] && restart
RETVAL=$?
;;
status)
status $prog
RETVAL=$?
;;
dump)
dump
;;
*)
echo $"Usage: $0 {start|stop|restart|reload|condrestart|status|dump}"
RETVAL=1
esac
exit $RETVAL
Current thread:
- Changing the interface Vernon Webb (Dec 18)
