Bob,

I have seen the same thing on some of my machines.
The hardware is different, the software is not.

I suspect some networkcards to be the problem.
I changed the startup script:

   daemon /usr/local/sbin/snort -t ......and so on......
   /sbin/ifconfig eth0 promisc

Snort is quite happy with this workaround ;-)

grtz,
sten

Bob Staaf wrote:
>
> Hello all,
>
> Newbie here with a couple of questions. I just installed Snort 1.7
> from rpm on a Red Hat 6.2 box. It has dual nics and I want to run snort on
> eth1. I installed libpcap via libpcap-0.4-19.i386.rpm from Red Hat. I went
> into /etc/rc.d/init.d/snortd and changed the Interface to eth1 and went into
> /etc/snort/snort.conf and changed the IP address to reflect the address on
> eth1. When I start snort it still tries to initialize eth0. I can force it
> with -i but, it won't go into promiscuous mode.
>
> Any ideas?
>
> Thanks
>
> Bob Staaf
> Southern Web Services
> Orlando, Fl
>
> _______________________________________________
> Snort-users mailing list
> Snort-userslists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users

-- 
It is impossible to make anything foolproof because fools are so
ingenious
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]