Re: RE: Newbie Question

[Jeff Ito <jeffi () rcn com>]

snort needs to be plugged into the mirror/promisc. port on the switch of
whatever segment you are monitoring, or of the switch that is your border
to the outside world to it monitors all traffic.

once you have that done, you need a second interface in the snort box,
in addition to the addressable one. that is the one that will drop
into promisc. mode and you are good to go.

jki


> How would you run snort in promiscuous mode?  Snort is logging only
> traffic destined for it.
>
> -----Original Message-----
> From: Bora Özden [mailto:bozden () altar-tr com]
> Sent: Tuesday, July 24, 2001 9:55 AM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Snort Report 1.0 released
>
>
> http://www.circuitsmaximus.com/ <http://www.circuitsmaximus.com/> 


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users