Trying to make eth0 promiscuous (without and IP)

[blkmax]

Hi I'm trying to make eth0 Promiscuous without an IP so that it can work with snort. When I use knetworkmanager it will not allow me to leave a blank IP address field.

In redhat the following works with their ifcfg-eth0 script.

DEVICE=eth0
BOOTPROTO=none
HWADDR=
ONBOOT=yes
TYPE=Ethernet

I cannot find what syntax to use for my interfaces script? All I have in mine currently is

auto lo
iface lo inet loopback

And the Man for Interfaces is quite confusing.

Essentially, I need eth0 to be enabled at boot without an IP address for Snort to sniff network traffic.

thanks

Marc

[blkmax]

Re: Trying to make eth0 promiscuous (without and IP)

I was able (I think) with the man page for interfaces to come up with the following lines for the interfaces script.

I added

auto eth0
iface eth0 inet static
address
netmask
up flush-mail

this seems to have worked. I need to test snort. Now because of this change my base web-page will no longer display. When I set up this system, an ipaddress was assigned for installation of updates/software. After all was done, I set my addapter into promiscuous mode.

marc

[blkmax]

Re: Trying to make eth0 promiscuous (without and IP)

After playing for a while, I found some odd behaviour. when I add the portion to make eth0 promiscuous, it seems to disable any other interface that I configured in it including lo (loopback), wich is why my apache is failing. when I comment out the part to make eth0 Promiscuous all is well. Here is my interfaces scripts.

If I have it like this lo works but eth0 is not promiscuous.

auto lo
iface lo inet loopback
address 127.0.0.1
netmask 255.0.0.0

# auto eth0
# iface eth0 inet static
# address
# netmask
# up flush-mail

If I have it like this lo fails

auto lo
iface lo inet loopback
address 127.0.0.1
netmask 255.0.0.0

auto eth0
iface eth0 inet static
address
netmask
up flush-mail

any ideas?

[blkmax]

Re: Trying to make eth0 promiscuous (without and IP)

I had to use the following script entry to get it to work with the pre -up and post -down.

iface eth0 inet manual
pre-up ifconfig $IFACE up
post-down ifconfig $IFACE down

now my lo is back and my apache server is displaying pages again.

Marc