Re: Listening to all devices

Hi Paul!


Probably, the interface on your machine is not in promiscuous mode.

You could try this command:

ip link set <inf> promisc on

 Please, let us know if it helps.


Best wishes,

Alexey

On 1 Mar 2024, at 13:50, Andrian Andrian <[email protected]> wrote:

Hi Paul,

I believe that is how Snort works, unless it is installed on your router/gateway/firewall and configured to monitor traffic on your LAN port, in which case it would be able to monitor traffic between your internal endpoints and the gateway.

From: Snort-users <[email protected]<mailto:[email protected]>> On Behalf Of Paul Giovanni
Sent: Thursday, February 29, 2024 12:26 AM
To: [email protected]<mailto:[email protected]>
Subject: [Snort-users] Listening to all devices

You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
Hello Snort community,

I am trying to get snort to detect all network packets on all network devices, but right now it seems to only be listening on the device I have it installed on. Is there something I’m missing? My config has

-- HOME_NET and EXTERNAL_NET must be set now
23 -- setup the network addresses you are protecting
24 HOME_NET = '10.0.0.0/24'

All I’m seeing are broadcast messages.

Thanks,

Paul Giovanni​​​​
IT Project Manager
Edison, NJ<https://goo.gl/alXFy5> P: <tel:7329855000> (732) 985-5000<tel:7329855000>
Gloucester City, NJ<https://goo.gl/PgMNnW> P: (856) 212-0050<tel:8562120050>
<image001.png><https://www.facebook.com/RaritanGroup/>
<image002.png><https://www.instagram.com/raritangroup/>
<image003.png><https://www.linkedin.com/company/raritan-group>
<image004.jpg><http://www.raritangroup.com/>



_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette