At 04:22 PM 2/26/02 -0600, rotbau wrote: > > > > 1. when I issued a halt command while logged onto the box > > with smoothwall installed I saw a message that said "eth0 > > entering promiscuous mode" as the box was shutting down. > > Is this just a way of saying that it is resetting the > > ipchains policies back to the default accept or something > > more sinister? In my experience promiscuous mode is not a > > good thing for you card to be at unless you are running a > > sniffer. > > That would be snort turning itself on or off. It's returning the interface to whatever mode it was in before snort ran. Sometimes that means you get an "entering promiscuous mode" during shutdown. It's good to know, but not a big deal. Many/most IDS systems run in promiscuous mode unless explicitly configured otherwise, so they can monitor packets for a whole network. -- Carl Patten