Have a look at the manual, here is a link to the section you should read.
http://www.snort.org/docs/snort_htmanuals/htmanual_2615/node32.html
Quantum Scientific wrote:
Eh, OK I will try it.
But surely there's a way to modify the .config file to do this? I
found no evidence of a Listen command, and ostensibly it is supposed
to be listening to *all* interfacen... but it only listens to one.
If I can't make it listen to the right interface without it going
off-line, Snort is of no use.
And is there a way to set 'no promisc' in .config? Is there a way to
have Snort email me alerts?
On Wednesday 22 August 2007, Jason wrote:
You can tell snort to listen to your wireless interface by using
"-i en1". Unfortunately this will likely take your wireless offline
as every time I put my card promisc it jumps off the ap. IIRC even
specifying no promisc has the same result.
Quantum Scientific wrote:
Hello Snorters,
I've just managed to get Snort running, but when I start it I see
that it starts on interface en0 (ethernet), rather than en1
(wifi). Ether net is not connected and wifi is my main
interface.
I've installed HenWen and changed some adjustments there, but
they didn't take. Maybe because I don't know how to run it as
Admin.
Also I find no setting in snort.conf for which interface to
listen on. There is a setting for local network, but I presume
that's to tell it what traffic to ignore.
How do I make it listen to an interface?
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Still grepping
through log files to find problems? Stop. Now Search log events and
configuration files using AJAX and a browser. Download your FREE copy
of Splunk now >> http://get.splunk.com/
_______________________________________________ Snort-users mailing
list Snort-users@lists.sourceforge.net Go to this URL to change user
options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users
list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
