Re: [Snort-devel] New Feature based on MAC address filterig (Possible !!!!!)

From: Erek Adams <erek(at)snort.org>
Date: Wed Jun 18 2003 - 13:19:15 EDT

On Tue, 17 Jun 2003, Atul Shrivastava wrote:

[...snip...]

> In my setup the snort sensor and management console is running on the

Both use libpcap. Both access the data at the same 'level'. The packets are seen by both, and there is no interference with each other.

One thing to make sure of: Promiscous mode. On some of the Linux boxes I've seen setting an interface to 'promisc' mode was a on/off switch. Send it a request to go into promisc, and it does. Send it a second one, and it goes out of promisc mode. Send a third, and it goes promisc again.

Cheers!

---

Erek Adams

   "When things get weird, the weird turn pro." H.S. Thompson

---

This SF.Net email is sponsored by: INetU Attention Web Developers & Consultants: Become An INetU Hosting Partner. Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission! INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Wed Jun 18 13:37:34 2003