Snort problem if WAN=pppoe0
running full version x86
built on Sat Dec 8 23:56:22 EST 2012
the problem is when snort tries to start, will not start if the interface that it bind to is pppoe. ???
/bin/pgrep -xf '/usr/local/bin/snort -R 4941 -D -q -l /var/log/snort/snort_pppoe04941 –pid-path /var/run --nolock-pidfile -G 4941 -c /usr/local/etc/snort/snort_4941_pppoe0/snort.conf -i pppoe0' > /var/run/snort_pppoe04941.pid
I have created a fudge fix by creating a /usr/local/etc/rc.d/test.sh the basically starts snort but uses my WAN interface
/usr/local/bin/snort -D -l /var/log/snort/snort_pppoe04941 -c /usr/local/etc/snort/snort_4941_pppoe0/snort.conf -i fxp0
This seems to work, however is there a better way to do it since the snort.sh file get rewritten every time you reconfigure it. I'm thinking maybe in the webconfig screen, give the user the ability to override the interface??
Just wondering if there has been any solutions to snort when the WAN is pppoe. See below for suggestion.