AW: [Snort-devel] check for promiscious mode needed ?

From: Andreas Wurzinger <andreas.wurzinger(at)salt-ag.com>
Date: Thu Apr 24 2003 - 03:07:02 EDT

On Wed, 23 Apr 2003, Andreas Wurzinger wrote:

> last week I had the phenomenon that snort died and as I tried to restart
some
> diagnosis on snort I discovered that when snort was not running the nic
was
> in promiscious mode and when snort came up the card switched over to
wether
> the promiscious mode on the sensor nic is already enabled or not ?

Lemmee guess, you're on Linux? Linux tends to implement the promisc setting as a flag. Set it once, and it's on. Set it twice and it's off. Set it three times and it's on.

Should Snort check? *shrug* That's a coder decsion. :)

---

Erek Adams

   "When things get weird, the weird turn pro." H.S. Thompson [Andreas Wurzinger]

Hi Erek,

youre right - its LINUX.

With that knowledge in mind its ok for me to deal with "sniffing-problems" on snort, but, anyway, a check wether the prom. mode is entered or not would be very *nice*

Andreas Wurzinger

---

This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven.
http://thinkgeek.com/sf

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Fri Apr 25 09:02:20 2003