Re: DAQ and ppp

[James Lay <jlay () slave-tothe-box net>]

On 2012-12-07 11:10, Greg Williams wrote:
> Ppp0 should be its own interface.  Try: sudo snort --daq afpacket -c
> intsnort.conf -i ppp0
>
> -----Original Message-----
> From: James Lay [mailto:jlay () slave-tothe-box net]
> Sent: Friday, December 07, 2012 11:07 AM
> To: Snort-users
> Subject: [Snort-users] DAQ and ppp
>
> Quick question...trying to run:
>
> sudo snort --daq afpacket -c intsnort.conf -i eth0:ppp0
>
> And I get:
>
> ERROR: Can't start DAQ (-1) - start_instance: invalid interface type
> for device ppp0: 512 != 1!
>
> This is 2.9.3.1.  Any hints on what this could be?  Cursory google
> wasn't fruitful.  Thanks all!
>
> James


Hrmm....my whole testing of this was to have one instance of snort, 
listening to two interfaces.  My tests worked with eth0 and 
say...another eth1 or eth2.  Even worked with eth0:wlan0.  Is this not a 
possibility with ppp interfaces?  And that's for the quick response 
Greg.

James


------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!