RE: stealth interface

["Sanderson, Josh" <JoshS () reddingbankofcommerce com>]

I was able to do that on Windows XP and 2000 by not binding any service or
protocol to the network card. If you want to connect through that interface
occasionally simply bind the TCP/IP protocol but uncheck it's box in the
connection configuration during normal monitoring. In linux I think it is
just /sbin/ifconfig eth0 -up .

Also, in response to Eric Baur's next mystery, can't you simply create a
symbolic link to ethX in the dev directory? Seems like I saw that mentioned
in a howto somewhere - possibly the Gentoo.org setup instructions.

> Is something like this possible on a windows system?


> Eric Baur wrote:
...snip....
>     That seems to be working in my installation (also RH8.0) without=20
> any issues.  (Now, my next mystery is seeing if I can find a way to=20
> refer to the devices as "lan", "wan" and "dmz" instead of "eth1",=20
> "eth2" and "eth3".)
> =20
> Eric
>  =20
> d_greenjr wrote:
>
> >     Can someone tell me or give me the URL on how to create an
> >     interface with no ipaddr (stealth), on a linux [RH8] system? (Not
> >     the receive only cable-I saw that in the snort FAQs)  I have
> >     searched the Internet and the snort archives but have not found a
> >     message/page that describes what to do-only the end results.  =
Thanks
>



-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
for complex code. Debugging C/C++ programs can leave you feeling lost and 
disoriented. TotalView can help you find your way. Available on major UNIX 
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users