Promiscuous Mode: Yes or No?

AvatarofVirgo · 02-22-2005, 07:32 PM

I installed SNORT and I was wondering what promiscuous mode does and what's it purpose and if I should turn it on.

Capt_Caveman · 02-22-2005, 07:56 PM

Makes Snort listen for all traffic on the wire, rather than traffic specifically addressed to or from the Snort box. If you're using Snort as a sensor or in a network rather than protecting a single system, then you'd want promiscuous mode turned on.

AvatarofVirgo · 02-22-2005, 08:06 PM

I have it running on a home computer with no network connected to the net with a dialup. So I guess I'll leave that mode off. But what would happen if I turned it on, does it make any difference if I turn it on when I don't need it?

Capt_Caveman · 02-22-2005, 08:22 PM

Quote:

Originally posted by AvatarofVirgo
I have it running on a home computer with no network connected to the net with a dialup. So I guess I'll leave that mode off. But what would happen if I turned it on, does it make any difference if I turn it on when I don't need it?

On a system with a cable connection, you might capture traffic from other hosts on your portion of the ISPs network, but on a dialup or DSL line where you aren't sharing a connection it shouldn't make a difference.