config within snort.conf

[Alberto Gonzalez <albertg () wwjh net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Erek,

In an earlier e-mail thread you stated that 'config' worked for you within 
your configuration file... here goes..

(root@cerebro)(/etc/snort) uname -a
OpenBSD cerebro.wwjh.net 3.2 GENERIC#25 i386

{ yea yea.... generic.... }

/etc/snort/snort.conf (config section)

##################################################
# Config Parameters
##################################################
config daemon
config dump_payload
config set_uid: snort
config set_gid: snort
config interface: fxp0

{ Im using default /var/log/snort logging btw } 

(root@cerebro)(/etc/snort) snort -T -c /etc/snort/snort.conf
Log directory = /var/log/snort

Initializing Network Interface rl0

[...snip...]

Mar 19 00:49:44 cerebro snort:  Snort sucessfully loaded all rules and 
checked all rule chains!

As you can see, even though I specified fxp0, it still uses rl0. An 
attempt to run snort, it will run fine, but with interface rl0 and run as 
user root and not in daemon mode. Im just having snort drops privs, its 
funky though that

(root@cerebro)(~) snort -d -c /etc/snort/snort.conf -i fxp0 -g snort -u snort -D 

works to perfection. I attempted to try it again since I just moved to 
1.9.1 and last time I checked I couldnt get this to work in 1.9.0. 

{ yea i had rpc_decode off }

(root@cerebro)(/etc/snort) snort -V

- -*> Snort! <*-
Version 1.9.1 (Build 231)
By Martin Roesch (roesch () sourcefire com, www.snort.org)

Anything else you need, though I do run it from the command line with all 
the arguments, buts it all cluttered its purdier to snort -c 
/etc/snort/snort.conf :)

If you need anything I will take the penalty drinks (just an excuse to 
drink really). 

 Cheers,
 Alberto Gonzalez

- -- 
"Success comes to the person who does today, what you are thinking of doing tomorrow." 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+eAeOa3vAB/3yp/IRAgOqAJ9X2r2DL9zEovk+492otJJDF3lkvACePHiv
0W8bYfPm0Y5Kk7f5j2tCkX8=
=/MK3
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.net email is sponsored by: Does your code think in ink? 
You could win a Tablet PC. Get a free Tablet PC hat just for playing. 
What are you waiting for?
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users