Re: making Snort listen to correct NIC

[Kevin Reiter <tux () penguinnetwerx net>]

David Naylor wrote:
> I've been trying to get Snort to listen to the correct NIC card.  When I use the -i flag it refuses to accept an IP address.  How else can you specify which NIC to use?  
>
> Any advice would be greatly appreciated.

try using snort -W to get a list of available interfaces.  Output might 
look like this:

C:\Snort\bin>snort -W

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.3.0-ODBC-MySQL-FlexRESP-WIN32 (Build 10)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2004 Sourcefire Inc., et al.


Interface       Device          Description
-------------------------------------------
1  \Device\NPF_{78B38C63-8EB2-4274-96A6-AD0CF4F3E651} (Intel(R) PRO/100 S 
Desktop Adapter)
2 \Device\NPF_{EF2BD197-9A14-4B16-B02B-A2C95979F964} (NET IP/1394 Miniport)
3 \Device\NPF_{3A5F988F-569B-439A-8AAB-3FAC7B28F9FF} (VMware Virtual 
Ethernet Adapter)
4 \Device\NPF_{3568FF80-7F6A-4B89-8450-C0FD2D268933} (VMware Virtual 
Ethernet Adapter)

..so to have Snort listen on my Intel NIC, I'd use -i1 (no space between 
-i and 1)

hth

-Kevin


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users