Hi,

I'm currently trying to use snort 1.7 on a NetBSD-1.5 home server with a
(rp-)pppoe connection. My ethernet card for the modem is fxp0 with 10.0.0.10
as IP adress. I have also a second card to my "home_net" which is rtk0 with
192.168.10.1 as IP adress.

1] When runing snort on rtk0 interface, all works well.

2] When runing snort on fxp0 interface, snort runs, but nothing is logged,
    it seems to not understand pppoe protocol :

Snort received 2012 packets and dropped 0(0.000%) packets

Breakdown by protocol: Action Stats:
    TCP: 0 (0.000%) ALERTS: 0
    UDP: 0 (0.000%) LOGGED: 0
   ICMP: 0 (0.000%) PASSED: 0
    ARP: 0 (0.000%)
   IPv6: 0 (0.000%)
    IPX: 0 (0.000%)
  OTHER: 2009 (99.851%)
DISCARD: 0 (0.000%)

3] When runing snort on ppp0 interface, I get the following message :

$ /usr/local/bin/snort -Afull -c /etc/snort/snort.conf -i ppp0

        --== Initializing Snort ==--

Initializing Network Interface ppp0

/usr/local/bin/snort cannot handle data link type 50
Exiting...

I feel a bit lost.... Is there someone to explain me what can I do ?

William Pomian

_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]