Snort problem if WAN=pppoe0



  • running full version x86
    2.1-BETA0 (i386)
    built on Sat Dec 8 23:56:22 EST 2012
    FreeBSD 8.3-RELEASE-p5

    the problem is when snort tries to start, will not start if the interface that it bind to is pppoe. ???

    re: snort.sh
    /bin/pgrep -xf '/usr/local/bin/snort -R 4941 -D -q -l /var/log/snort/snort_pppoe04941 –pid-path /var/run --nolock-pidfile -G 4941 -c /usr/local/etc/snort/snort_4941_pppoe0/snort.conf -i pppoe0' > /var/run/snort_pppoe04941.pid

    I have created a fudge fix by creating a /usr/local/etc/rc.d/test.sh the basically starts snort but uses my WAN interface
    #!/bin/sh
    killall snort
    sleep 2
    /usr/local/bin/snort -D -l /var/log/snort/snort_pppoe04941 -c /usr/local/etc/snort/snort_4941_pppoe0/snort.conf -i fxp0

    This seems to work, however is there a better way to do it since the snort.sh file get rewritten every time you reconfigure it. I'm thinking maybe in the webconfig screen, give the user the ability to override the interface??



  • Just wondering if there has been any solutions to snort when the WAN is pppoe. See below for suggestion.


Locked