Hi,
I'm trying to run Snort in promiscious mode, however it's not working properly. I only see packets destined to and from the machine running snort, and not network traffic.
I've tried on both Fedora, Redhat, and Windows. On the Linux systems, I set the appropriate interface to promiscuous mode using: ifconfig eth0 promisc

The interface shows up in promiscuous mode, but when I run snort, or any other packet sniffer such as ethereal or tcpdump, I see only broadcasts and packets directed to the machine in question -- no other traffic. Can anyone give me some direction on this? I'm not sure what to try next. All machines are behind a $10 linksys 5 port hub.

Hi Yohhan,

Is the Linksys device a switch? If so, only traffic destined for a certain computer's IP or broadcast will be seen by that computer.

You can monitor switched traffic by fooling the other computers & the switch; see http://monkey.org/~dugsong/dsniff/

~ loop0