Snort mailing list archives
Problem with ethercard and promiscuous mode
From: Jim Patterson <jim_patterson () comcast net>
Date: Mon, 29 Mar 2004 22:57:49 -0600
On my snort system I have two ethernet cards and was attempting to monitor both outside of the firewall and inside of the firewall. When I monitor with eth0 I don't have a problem, but eth1 appears to refuse to go into promiscuous mode. I have run "ifconfig eth1 promisc up" and it doesn't seem to have any affect except on ifconfig which returns that it is in PROMISC. I test it by running tcpdump and seeing if I can see traffic on a hub, but with the card in eth1 it doesn't appear to work. if I switch and use the card designated eth0 , connected with the same cable, then I can see the traffic. I believe that the testing has ruled out the hub or the cable being the problem. Both cards are the same, just one of them appears not to be able to go into promiscuous mode. Anyboy ran into a problem like this? Any possible solutions? Is it really possible that I have a bad card and it won't go into promiscuous mode?
------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Problem with ethercard and promiscuous mode Jim Patterson (Mar 29)
- Re: Problem with ethercard and promiscuous mode Josh Berry (Mar 30)
- Re: Problem with ethercard and promiscuous mode Jim Patterson (Mar 31)
- Re: Problem with ethercard and promiscuous mode Josh Berry (Mar 30)