Re: Problem snort

Hello,


Afpacket will create the bridge once started. You are only specifying one interface (and you need two).


See the README file in the daq download for details (part of it is below).


AFPACKET Module
===============

afpacket functions similar to the pcap DAQ but with better performance:

    ./snort --daq afpacket -i <device>
            [--daq-var buffer_size_mb=<#MB>]
            [--daq-var debug]

If you want to run afpacket in inline mode, you must craft the device string as
one or more interface pairs, where each member of a pair is separated by a
single colon and each pair is separated by a double colon like this:

    eth0:eth1

or this:

    eth0:eth1::eth2:eth3





Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]<mailto:[email protected]>



From: Snort-users <[email protected]> on behalf of Six Tuur via Snort-users <[email protected]>
Reply-To: Six Tuur <[email protected]>
Date: Wednesday, April 6, 2022 at 3:42 PM
To: "[email protected]" <[email protected]>
Subject: [Snort-users] Problem snort

Dear snort-users
I have problem with my snort configuration. I want to put my snort configuration in Inline mode to make it an IPS and block curtain traffic.
[cid:fd24a3ea-961c-4d87-b3de-8c0e47795e80]
From research of the Internet both interfaces has to stand on promiscuous and need to be bridged. Is this with an IP or how do you make this machine manageable with ssh? I first try it on a virtuele machine and after with a physical machine, but I get the next error. (I always get the error when I change the snort.conf file to do inline mode).
[cid:82909a7c-780e-4560-8f99-a962dc7f9638]

If someone could help me it would be very nice.

Cheers
Tuur Six

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette