Snort.org home  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort
Snort News Downloads Snort Docs Rules Snort Community Snort Forums Snort Training
Search Site
Search Rules
Account
email
password
not registered?
user preferences

Snort Forums Archive

Archive Home » Windows » Snort is running at other interface

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Snort is running at other interface


Posted by Karabas on January 11, 2006 23:15:34

Under W2k3 installed Snort 2.4.3.
I have seen list of interfaces:

snort.exe –W

Snort launched as service with binding to interface (№2):

snort.exe /SERVICE /INSTALL -i 2 –c

Then activate VPN-channel. I have seen list of interfaces again:

snort.exe –W

Now the second interface is (WAN (PPP/SLIP) Interface) VPN-channel. Snort is running at other interface. How solve the problem?

Posted by crs51885 on January 12, 2006 05:13:57

Hi Karabas,

Try doing this:

Go to Control Panel -> Network Connections. Click on the Advanced menu at the top and go to Advanced Options. Select the virtual WAN adapter and move it down below the adapter on which you want snort to listen. Click OK and try snort again.

The procedure above changes the priority of the adapters in Windows and I believe changes the order they appear to Snort. If this doesn't fix the problem, let me know, I have another idea that may correct it, but I think this should.

Hope this helps.

Posted by Karabas on January 12, 2006 23:30:54

At this menu item did not displays VPN-interfaces. Displayed Remote Access Connections - in the end of list.

VPN-interfaces displays at RRAS snap-in (Network Interfaces), but did not have tools to change interface metrics.

Posted by Karabas on January 13, 2006 02:20:33

I manualy change metrics for network interfaces (1, 2, ...), but WAN (PPP/SLIP) Interface did not move down in interface list (snort -W).

Posted by ET2_Monty on December 21, 2006 09:22:45

I had a similar issue with Snort looking for the wrong adapter, even when I had specified it in the conf file. Moving the order fixed that. Thanks.
site feedback | Terms of Use | Privacy Policy | forum archives ©2007 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.