RE: promiscuous mode

[wedgebreaker () mail lokmail net]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> What difference does it make to run an interface in promiscuous mode?  =
> My snort data collection seems to work the same either way.

Depends what you are sniffing.  If you are running snort on your iptables linux firewall (external interface) connected 
via point-to-point DSL, then all (or most) of the traffic you'll see is destined for that external IP, therefore 
promisc mode is unnecessary.  If you are running snort on a corporate type IDS where you are sniffing traffic to a 
webfarm (or any IPs that are not on the box you are running snort on), you will need promiscuous mode.

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1 (C) 1997-1999 Network Associates, Inc. and its affiliated companies. 
(Diffie-Helman/DSS-only version)

iQA/AwUBPBs+1JB6EO8P9WTfEQLNlwCeMxVrb/3sAVzbR55lXrnkxACzgpkAniPm
kkULPTSRMPpeo3IwxZ25s6Du
=qmPc
-----END PGP SIGNATURE-----

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users