Re: [Snort-users] making Snort listen to correct NIC

David Naylor wrote:
> I've been trying to get Snort to listen to the correct NIC card. When I use the -i flag it refuses to accept an IP address. How else can you specify which NIC to use?
>
> Any advice would be greatly appreciated.

try using snort -W to get a list of available interfaces. Output might
look like this:

C:\Snort\bin>snort -W

,,_ -*> Snort! <*-
o" )~ Version 2.3.0-ODBC-MySQL-FlexRESP-WIN32 (Build 10)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
(C) Copyright 1998-2004 Sourcefire Inc., et al.


Interface Device Description
-------------------------------------------
1 \Device\NPF_{78B38C63-8EB2-4274-96A6-AD0CF4F3E651} (Intel(R) PRO/100 S
Desktop Adapter)
2 \Device\NPF_{EF2BD197-9A14-4B16-B02B-A2C95979F964} (NET IP/1394 Miniport)
3 \Device\NPF_{3A5F988F-569B-439A-8AAB-3FAC7B28F9FF} (VMware Virtual
Ethernet Adapter)
4 \Device\NPF_{3568FF80-7F6A-4B89-8450-C0FD2D268933} (VMware Virtual
Ethernet Adapter)

...so to have Snort listen on my Intel NIC, I'd use -i1 (no space between
-i and 1)

hth

-Kevin


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users