strange promiscuous behaviour.

[Brock Henry <bhenry () shorelink nsw gov au>]

Hi :)

I recently installed snort (again), and had it working initially, but then 
it stopped for no apparent reason.

even snort -dvi eth0 only gave back minimal traffic, arp's and other 
broadcasted(?) traffic.

in /var/log/messages each time I started snort it "left promiscuous mode", 
and each time stopped snort it "entered promiscuous mode", as opposed to 
the other way around.

I read in the archives about libpcap not checking promisc mode, and just 
toggling it. So I cycled the machine so it started back in the correct 
mode, then snort worked properly.

It didn't matter if snort was in daemon mode or not. I'm not sure how the 
problem started, but I'll keep an eye on it, just thought I'd mention my 
experiences.

Brock Henry

** Brock Henry - brockh () ozemail com au (H) - bhenry () shorelink nsw gov au (W) **
** Adventure? Excitement? A Jedi craves not these things.**


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users