Re: Couple of quick questions

[Charles Lacroix <chuck () linuxquebec com>]

On Tuesday 23 March 2004 18:40, Jason Haar wrote:
> On Tue, Mar 23, 2004 at 09:40:07PM +0000, Bennett Todd wrote:
> > I've deployed snort listening on bonded eth interfaces successully.
> > The one quirk, which may have been fixed since, was that promisc
> > wasn't being passed down from bond0 to the bonded ethN interfaces
> > when snort tried to set promisc; the simple fix was to explicitly
> > ifconfig bond0 promisc before ifenslaving the ethN interfaces;
> > promisc _is_ propogated down to the ethN interfaces at ifenslave
> > time.
>
> That's weird. I've got one Snort box here using bond0 to aggregate two
> i82557/i82558 chipset eepro100 Ethernet cards under Linux, ifconfig doesn't
> show "PROMISC" anywhere on anything, and yet it's certainly running promisc
> as I'm seeing alerts from non-Snort IP addresses....
>
> [I just love that "bond" feature :-). No cracks about "bond"age please!
> ;-)]

Thanks for the bond stuff, i'll test it out in a few weeks.

For the interface, i was able to snort the data in the cipcb* and ppp*
interfaces no problem, the only trouble i had was the init script
like the line i pasted, so now i am ok.

So bottom line, we need someone to change the init script in this rpm.
so that it checks other type than ethernet interfaces since many people
use dsl connections and vpn technologies these days.

Anyways
thanks for the comments

charles







-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users