I've been prowling through the FreeBSD and Snort list archives in search of information on setting up snort on a FreeBSD bridge(4) that logs to a remote postgres box via a third interface (hme0) Snort is being started with the following command: /usr/local/bin/snort -A full -D -e -d -s -i fxp0 -c /usr /local/etc/snort.conf Where fxp0 and fxp1 are in the bridge output from sysctl: net.link.ether.bridge_cfg: fxp0:0,fxp1:0 net.link.ether.bridge: 1 net.link.ether.bridge_ipfw: 0 net.link.ether.bridge_ipf: 1 net.link.ether.bridge_ipfw_drop: 0 net.link.ether.bridge_ipfw_collisions: 0 The snort.conf is attached. I've attempted to start with a pretty generic config, just to ensure things work. The problem appears to be that snort simply doesn't log to the remote postgres box (yes, there are host entries in pg_hba.conf, and other databases are accessible remotely, so I believe that is not the issue). I've just been running trafshow to watch connections. Any hints/pointers/solutions welcome. Thanks -- Louis Kowolowski louisk@cryptomonkeys.org Crypto Monkeys: http://www.cryptomonkeys.org/~louisk IRC: outcast-consultants.biz#outcasts gpg info: http://www.cryptomonkeys.org/~louisk/gurgi.html gpg print: F04B 9A37 822A 4CE1 95CE 4D28 1AFF CCB7 DE4B A841 Everyone is a genius. It's just that some people are too stupid to realize it. -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 187 bytes Desc: not available Url : http://lists.freebsd.org/pipermail/freebsd-security/attachments/20030828/5cdd21c2/attachment.bin