Hi I am new to this forum and my knowledge about iptables is fairly limited. I did search but couldn't find an answer to my question; if this has been addressed elsewhere, please point me to the source. Anyway, here is my situation. I have fwsnort generate iptables rule (based on snort IDS rules) which are running on a machine with two interfaces. One of the interfaces (eth1) is connected to a SPAN port that mirrors traffic on part of our network, this interface is in promiscuous mode. The other interface (eth0) is a regular addressable interface. For some reason, the iptables rules seem to have no effect on traffic seen by the SPAN port. It seems to work fine on traffic seen on eth0. I have tried using the -i option to specify the interface but that doesn't seem to help. I am trying simple rules like "look for string 'ssh' and LOG traffic as well as reject with tcp reset" to troubleshoot. Anyone have any idea what I need to do to have iptables rule to act on SPAN traffic. Tcpdump on eth1 does show traffic that the loaded iptables rules should catch. Am I missing something in the way I have set things up? Thanks, Siva
