|Main Archive Page > Month Archives > snort-users archives|
I am having a bit of a problem getting Snort to run on different interfaces on Linux. I have a bridge setup (br0) that is bridged with eth1 (my primary physical interface connected to the network). I also have another bridge (br1) that connects a number of other virtual interfaces (mostly for VM's), such as vif1, vif2, etc. My issue is when I issue a command such as:
snort -i br1 -dev
All I see is traffic from br0. This occurs with every other interface on my system. No errors are generated, however when snort is initialized (no matter the interface specified, even if its jiberish) I see this information:
--== Initializing Snort ==--
Initializing Output Plugins!
So it seems to me that snort is ignoring my '-i' switch, and just using the first active interface, which would be br0. It would appear that there may be an issue with the interface detection script, in that it is only see "br0" as active. However, this certainly seems like a bug because A.) Network traffic flows as excepted from each of the interfaces, and B.) tcpdump -i works perfectly on all the interfaces.
So the question is, does anyone have an idea as to what is going wrong, or what I can do to remidy this issue? I've searched for hours on this issue and havent found much, so any help would be appreciated.