RE: how to specify network interface card (windows) ?

["L. Christopher Luther" <CLuther () Xybernaut com>]

If you look at Snort's error, you don't have an interface '0', and you're
getting this error because you've lanched Snort using only '-i'.

If you want Snort to listen on interface 2, then launch Snort as:  

    C:\Program Files\Snort\bin>snort -i 2 

If you want Snort to listen on interface 3, then launch Snort as:  

    C:\Program Files\Snort\bin>snort -i 3

The key is specifying the interface number *along with* the '-i' parameter,
not just '-i' by alone.  

HTH 


-----Original Message-----
From: lukasz [mailto:lzg () slb com]
Sent: Friday, June 20, 2003 12:37 PM
To: L. Christopher Luther
Subject: RE: [Snort-users] how to specify network interface card
(windows) ?


Chris,

Any special way to enter the device name?

here is my output and error message

C:\Program Files\Snort\bin>snort -W

-*> Snort! <*-
Version 2.0.0-ODBC-MySQL-FlexRESP-WIN32 (Build 72)
By Martin Roesch (roesch () sourcefire com, www.snort.org)
1.7-WIN32 Port By Michael Davis (mike () datanerds net,
www.datanerds.net/~mike)
1.8 - 2.0 WIN32 Port By Chris Reid (chris.reid () codecraftconsultants com)

Interface       Device          Description
-------------------------------------------
1  \Device\Packet_NdisWanIp (NDISWANIP NdisWan Adapter)
2 \Device\Packet_{E670FB4B-DA1F-4C7E-A104-F0223FB35D44} (EL90Xbc5 3Com
EtherLink
 PCI)
3 \Device\Packet_{B11D2C1F-78E4-4E92-8A0C-DAD53F2CCB75} (EL55612 3Com 10/100
Min
i PCI Ethernet Adapter)


C:\Program Files\Snort\bin>snort -i
\Device\Packet_{E670FB4B-DA1F-4C7E-A104-F022
3FB35D44}
ERROR: Invalid interface '0'.Fatal Error, Quitting..

C:\Program Files\Snort\bin>


Lukasz

-----Original Message-----
From: L. Christopher Luther [mailto:CLuther () Xybernaut com]
Sent: Friday, June 20, 2003 12:15 PM
To: 'Lukasz Gogolewski'; Snort-Users
Subject: RE: [Snort-users] how to specify network interface card
(windows) ?


Run Snort like:

        snort -W

see the list of Windows interfaces:

-*> Snort! <*-
Version 1.8.7beta5-ODBC-MySQL-WIN32 (Build 130)
By Martin Roesch (roesch () sourcefire com, www.snort.org)
1.7-WIN32 Port By Michael Davis (mike () datanerds net,
www.datanerds.net/~mike)
1.8-WIN32 Port By Chris Reid (chris.reid () codecraftconsultants com)
          (based on code from 1.7 port)

Interface       Device          Description
-------------------------------------------
1 \Device\Packet_{9AC501B5-EBBF-4B2E-918F-9E3C8F93480F} (FE575 Ethernet
Adapter)
2 \Device\Packet_NdisWanIp (NdisWan Adapter)

Then launch Snort using '-i n' where 'n' is the interface you want Snort to
monitor.

Cheers!


-----Original Message-----
From: Lukasz Gogolewski [mailto:lzg () slb com]
Sent: Friday, June 20, 2003 11:06 AM
To: Snort-Users
Subject: [Snort-users] how to specify network interface card (windows)?


Hello snort users,

I've just started using snort and find this application really amazing.

At this time I have 3 network cards on my Windows system, however I'd like
to monitor traffic only using one of them.

How can I specify names for network cards under windows ./snort -i ???

I've seen how it's done under *nix systems but couldn't find much about
windows.

thanks for any input.

lukasz



-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users