Snort mailing list archives
RE: interface on promiscuous mode ?
From: "Sean T. Ballard" <stballard () 4glschools com>
Date: Fri, 22 Mar 2002 16:57:30 -0500
do ifconfig -promisc then tcpdump and see if it comes up -----Original Message----- From: Mike_Sands () elementk com [mailto:Mike_Sands () elementk com] Sent: Friday, March 22, 2002 4:14 PM To: Ashley Thomas Cc: snort-users () lists sourceforge net; snort-users-admin () lists sourceforge net Subject: Re: [Snort-users] interface on promiscuous mode ? Have you mirrored or spanned the ports on the switch that the machine is connected to? Mike Sands Security / Network Engineer Element K 'the knowledge catalyst' www.elementk.com |--------+---------------------------------------> | | Ashley Thomas | | | <athomas () unity ncsu edu> | | | Sent by: | | | snort-users-admin@lists.sourc| | | eforge.net | | | | | | | | | 03/22/2002 02:10 PM | | | | |--------+--------------------------------------->
-----------------------------------------------------------------------
-------------------------------------| | | | To: snort-users () lists sourceforge net | | cc: | | | | Subject: [Snort-users] interface on promiscuous mode ? |
-----------------------------------------------------------------------
-------------------------------------| hi, i am setting up snort on a linux machine and needs the ethernet interface to be in stealth mode. so i did a simple "ifconfig eth0 up" and see the ifconfig -a as: eth1 Link encap:Ethernet HWaddr 00:03:86:45:BB:77 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1029434 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 Interrupt:5 Memory:f9000000-f9020000 But i see only arp and broadcast packets when i do a tcpdump -i eth1 Looking at /var/log/messages, i don't see "device eth1 entered promiscuous mode" Is this the problem ? How do i make it go into promiscuous mode ? thanks _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- interface on promiscuous mode ? Ashley Thomas (Mar 22)
- <Possible follow-ups>
- RE: interface on promiscuous mode ? Wirth, Jeff (Mar 22)
- RE: interface on promiscuous mode ? Slighter, Tim (Mar 22)
- Re: interface on promiscuous mode ? Mike_Sands (Mar 22)
- RE: interface on promiscuous mode ? Sean T. Ballard (Mar 22)