You can tell snort to listen to your wireless interface by using "-i
en1". Unfortunately this will likely take your wireless offline as every
time I put my card promisc it jumps off the ap. IIRC even specifying no
promisc has the same result.
Quantum Scientific wrote:
Hello Snorters,
I've just managed to get Snort running, but when I start it I see that it
starts on interface en0 (ethernet), rather than en1 (wifi). Ether net is not
connected and wifi is my main interface.
I've installed HenWen and changed some adjustments there, but they didn't
take. Maybe because I don't know how to run it as Admin.
Also I find no setting in snort.conf for which interface to listen on. There
is a setting for local network, but I presume that's to tell it what traffic
to ignore.
How do I make it listen to an interface?
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
