Re: Problem Running Snort 3 Inline

Jim,

Are you seeing PCAP coming through afpacket and Snort or is that not even working?

One of my suggestions might be about promiscuous mode for your monitor port. 

Nick


> On Jun 19, 2023, at 18:29, Jim Campbell via Snort-users <[email protected]> wrote:
> 
> I have run Snort as an IPS for a number of years in the inline mode. When using Snort 2 I didn't seem to have any problem inserting it between the modem and the router. Not so with Snort 3. When I put Snort 3 between the cable modem and the router, the router loses connection to the internet.
> 
> In addition to going to Snort 3 I also upgraded my router to a Netgear Nighthawk MR60 Mesh Router.
> 
> Ubuntu is a fresh install of Ubuntu Desktop 20.04.6.  I used Noah Dietrich's writeup "Snort 3.1.18.0 on Ubuntu 18 and 20" to install Snort 3.  I'm attaching the Snort 3 systemd service file I'm using and the Snort version file.
> 
> Any suggestions would be very much appreciated.
> 
> Jim Campbell
> 
> 
> 
> <Snort3.jpg>
> <Version.jpg>
> _______________________________________________
> Snort-users mailing list
> [email protected]
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
> 
>    To unsubscribe, send an email to:
>    [email protected]
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
> 
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette