I'm just noticing that when I run Snort the interface I have specified in the config file to listen on isn't actually entering promiscuous mode. The log says that it is, however ifconfig shows differently. I can manually bring it up with ifconfig eth0 promisc, and drop it the same way.
I don't understand what's going on behind the scenes with this. If there kernlog is saying it changes state, it obviously thinks it did but why? And the obvious question is how to fix this so it works according to plan... Cheers, /eli ... UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 ... Oct 29 16:16:41 tardis snort: Initializing Output Plugins! Oct 29 16:16:41 tardis kernel: device eth0 entered promiscuous mode Oct 29 16:16:41 tardis snort: Initializing daemon mode ... -- CAUTION: Repeated use of finger can cause a system to become overloaded, which can cause it to stop responding. --Infinite wisdom from the font that is ISS 6.2.1 --=_tardis.ath.cx-24604-1035926564-0001-2-- -- CAUTION: Repeated use of finger can cause a system to become overloaded, which can cause it to stop responding. --Infinite wisdom from the font that is ISS 6.2.1
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
