Re: Snort in IPS mode

[turki <turki_00 () yahoo com>]

What if I only have single interface card "eth0" ?
can I redirect/pair the traffic to itself (i know it is kind of silly statement)
something like this:

snort -Q --daq afpacket -i eth0:eth0 -c snort.conf

--- On Mon, 5/16/11, Michael Altizer <xiche () verizon net> wrote:

From: Michael Altizer <xiche () verizon net>
Subject: Re: [Snort-users] Snort in IPS mode
To: snort-users () lists sourceforge net
Received: Monday, May 16, 2011, 6:27 AM



  

    
  On 05/15/2011 08:09 PM, turki wrote:
    
      
        
          
            Hi,

              I am new to snort, so i need help here.

              

              I am trying to run snort in inline mode with the following
              command:

              snort -Q --daq afpacket -i eth0 -c snort.conf

              

              but snort initialization keeps failing with error message:

              

              afpacket DAQ configured to inline.

              ERROR: Can't initialize DAQ afpacket (-1) -
              afpacket_daq_initialize: Invalid interface specification:
              'eth0'!

              Fatal Error, Quitting..

            
          
        
      
    
    In order to have an inline deployment you need at least one pair of
    interfaces for the traffic to flow through.  To that end, you need
    to specify a second interface for AFPacket to use to complete the
    bridge.

    

    For example:

    snort -Q --daq afpacket -i eth0:eth1 -c snort.conf

    

    or (two inline pairs):

    

    snort -Q --daq afpacket -i eth0:eth1::eth2:eth3 -c snort.conf

  

-----Inline Attachment Follows-----

------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay
-----Inline Attachment Follows-----

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users