2/24
Hello,
Thanks to Mr. Maria Lopez Hernandez for responding especially for
clearly pointing the change to me. I am not well versed in scripts.
I did as was advised. When I try to start the service it fails. Is
there anything more that I should do to get the script running on all
three interfaces?
Thank you.
----------------------------------------------------------------------------------------
HISTORY
-----------------------------------------------------------------------------------------
Message: 7
Date: Wed, 23 Feb 2005 17:12:47 -0500
From: Jiju Menon <security4rrm@gmail.com>
Reply-To: Jiju Menon <security4rrm@gmail.com>
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Snort Deamon
IHello,
I am trying to use a Snort daemon from the website
http://msbnetworks.net/snort/snortd.txt,
I am running snort on a machine with 3 interfaces and I would like to
run snort in all interfaces.
There is a parameter INTERFACE= , in the file. What value should I
give if I want snort to sniff all interfaces?
By default, it takes only eth0 and does not seem to change interface
even if I specify eth1, or eth2.
Any help is welcome.
Thank you
--__--__--
Message: 8
Subject: Re: [Snort-users] Snort Deamon
From: Jose Maria Lopez Hernandez <jkerouac@bgsec.com>
To: "snort-users@lists.sourceforge.net" <snort-users@lists.sourceforge.net>
Organization: bgSEC
Date: Wed, 23 Feb 2005 23:46:52 +0100
El mi=C3=A9, 23-02-2005 a las 17:12 -0500, Jiju Menon escribi=C3=B3:
IHello,
=20
I am trying to use a Snort daemon from the website
http://msbnetworks.net/snort/snortd.txt,
=20
I am running snort on a machine with 3 interfaces and I would like to
run snort in all interfaces.
There is a parameter INTERFACE=3D , in the file. What value should I
give if I want snort to sniff all interfaces?
Just use:
INTERFACE=3Dany
But you have to change the script. What it's wrong it's the script
you are using. It specifies the variable INTERFACE but it doesn't
use it later to launch snort, so it won't work.
Change the line:
daemon /usr/local/bin/snort -u snort -g snort -d -D \
-c /etc/snort/snort.conf
to:
daemon /usr/local/bin/snort -u snort -g snort -d -i $INTERFACE -D \
-c /etc/snort/snort.conf
and it will work.
By default, it takes only eth0 and does not seem to change interface
even if I specify eth1, or eth2.
=20
Any help is welcome.
=20
Thank you
Regards.
--=20
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
