Snort problem if WAN=pppoe0
-
running full version x86
2.1-BETA0 (i386)
built on Sat Dec 8 23:56:22 EST 2012
FreeBSD 8.3-RELEASE-p5the problem is when snort tries to start, will not start if the interface that it bind to is pppoe. ???
re: snort.sh
/bin/pgrep -xf '/usr/local/bin/snort -R 4941 -D -q -l /var/log/snort/snort_pppoe04941 –pid-path /var/run --nolock-pidfile -G 4941 -c /usr/local/etc/snort/snort_4941_pppoe0/snort.conf -i pppoe0' > /var/run/snort_pppoe04941.pidI have created a fudge fix by creating a /usr/local/etc/rc.d/test.sh the basically starts snort but uses my WAN interface
#!/bin/sh
killall snort
sleep 2
/usr/local/bin/snort -D -l /var/log/snort/snort_pppoe04941 -c /usr/local/etc/snort/snort_4941_pppoe0/snort.conf -i fxp0This seems to work, however is there a better way to do it since the snort.sh file get rewritten every time you reconfigure it. I'm thinking maybe in the webconfig screen, give the user the ability to override the interface??
-
Just wondering if there has been any solutions to snort when the WAN is pppoe. See below for suggestion.