[gentoo-user] Changing the NIC name

[gentoo-user] Changing the NIC name

[Timothy A. Holmes]

Hi folks

I have a snort server that I am building that has 2 nics in it

One is a 10/100 realtec
The other is a 10/100/1000 Intel Pro1000

As the machine built, the realtech is eth0 and the intel is eth1

I would like to reverse those two names, so that snort can use the
higher capacity card for its sniffer.  I am not quite sure where to look
even to begin this process.

Thanks

Timothy A. Holmes
IT Manager / Network Admin / Web Master / Computer Teacher
 
Medina Christian Academy
A Higher Standard...
 
Jeremiah 33:3
Jeremiah 29:11
Esther 4:14


-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Changing the NIC name

[Hans-Werner Hilse]

Hi,

On Mon, 6 Nov 2006 09:09:40 -0500 "Timothy A. Holmes"
<tholmes@mcaschool.net> wrote:

> As the machine built, the realtech is eth0 and the intel is eth1
> 
> I would like to reverse those two names, so that snort can use the
> higher capacity card for its sniffer.  I am not quite sure where to
> look even to begin this process.

You can give arbitrary names to those interfaces by configuring udev
appropriately:

e.g. /etc/udev/rules.d/10-my-own-rules:
---snip
KERNEL=="eth*", SYSFS{address}=="00:12:34:fe:dc:ba", NAME="eth-lan"
KERNEL=="eth*", SYSFS{address}=="00:56:78:98:76:54", NAME="eth-sniff"
---snip

-hwh
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Changing the NIC name

[Novensiles divi Flamen]

[-- Attachment #1: Type: text/plain, Size: 702 bytes --]

On Monday 06 November 2006 21:59, Hans-Werner Hilse wrote:

> > I would like to reverse those two names, so that snort can use the
> > higher capacity card for its sniffer.  I am not quite sure where to
> > look even to begin this process.
>
> You can give arbitrary names to those interfaces by configuring udev
> appropriately:
>
> e.g. /etc/udev/rules.d/10-my-own-rules:
> ---snip
> KERNEL=="eth*", SYSFS{address}=="00:12:34:fe:dc:ba", NAME="eth-lan"
> KERNEL=="eth*", SYSFS{address}=="00:56:78:98:76:54", NAME="eth-sniff"
> ---snip

You could also just tell Snort to use eth1. But this is useful info.

- Noven
-- 
>-- Novensiles divi Flamen --<
>---- Miles Militis Fons ----<

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

RE: [gentoo-user] Changing the NIC name

[Timothy A. Holmes]

> On Monday 06 November 2006 21:59, Hans-Werner Hilse wrote:
> 
> > > I would like to reverse those two names, so that snort 
> can use the 
> > > higher capacity card for its sniffer.  I am not quite 
> sure where to 
> > > look even to begin this process.
> >
> > You can give arbitrary names to those interfaces by configuring udev
> > appropriately:
> >
> > e.g. /etc/udev/rules.d/10-my-own-rules:
> > ---snip
> > KERNEL=="eth*", SYSFS{address}=="00:12:34:fe:dc:ba", NAME="eth-lan"
> > KERNEL=="eth*", SYSFS{address}=="00:56:78:98:76:54", 
> NAME="eth-sniff"
> > ---snip
> 
> You could also just tell Snort to use eth1. But this is useful info.
> 
> - Noven
> -- 
> >-- Novensiles divi Flamen --<
> >---- Miles Militis Fons ----<
> 
>

Ive been trying to do that - I can do it from command line, but not from
init script which is why im trying to change the names around

Timothy A. Holmes
IT Manager / Network Admin / Web Master / Computer Teacher
Medina Christian Academy
A Higher Standard...


-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Changing the NIC name

[Daniel Iliev]

Timothy A. Holmes wrote:
>> On Monday 06 November 2006 21:59, Hans-Werner Hilse wrote:
>>
>>     
>>>> I would like to reverse those two names, so that snort 
>>>>         
>> can use the 
>>     
>>>> higher capacity card for its sniffer.  I am not quite 
>>>>         
>> sure where to 
>>     
>>>> look even to begin this process.
>>>>         
>>> You can give arbitrary names to those interfaces by configuring udev
>>> appropriately:
>>>
>>> e.g. /etc/udev/rules.d/10-my-own-rules:
>>> ---snip
>>> KERNEL=="eth*", SYSFS{address}=="00:12:34:fe:dc:ba", NAME="eth-lan"
>>> KERNEL=="eth*", SYSFS{address}=="00:56:78:98:76:54", 
>>>       
>> NAME="eth-sniff"
>>     
>>> ---snip
>>>       
>> You could also just tell Snort to use eth1. But this is useful info.
>>
>> - Noven
>> -- 
>>     
>>> -- Novensiles divi Flamen --<
>>> ---- Miles Militis Fons ----<
>>>       
>>     
>
> Ive been trying to do that - I can do it from command line, but not from
> init script which is why im trying to change the names around
>
> Timothy A. Holmes
> IT Manager / Network Admin / Web Master / Computer Teacher
> Medina Christian Academy
> A Higher Standard...
>
>
>   

Another approach:
When linux loads the modules it assigns the names by the order of
loading. If the module for the Intel NIC is loaded first it becomes
eth0, the next NIC whose module is loaded becomes eth1 and so on.
If you have your drivers built into the kernel then the names are
related to the PCI slots - the NIC connected to the PCI with lowest
number become eth0 and so on. So you could change their places on the
main board.


HTH

-- 
Best regards,
Daniel


-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Changing the NIC name

[Michael Schreckenbauer]

Hi,

Am Montag, 6. November 2006 15:09 schrieb Timothy A. Holmes:
> Hi folks
> I have a snort server that I am building that has 2 nics in it
> One is a 10/100 realtec
> The other is a 10/100/1000 Intel Pro1000
> As the machine built, the realtech is eth0 and the intel is eth1
> I would like to reverse those two names, so that snort can use the
> higher capacity card for its sniffer.  I am not quite sure where to look
> even to begin this process.

"nameif" does this.

# equery b nameif
[ Searching for file(s) nameif in *... ]
sys-apps/net-tools-1.60-r12 (/sbin/nameif)

# nameif <interface> <macaddress>

Hth,
Michael

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Changing the NIC name

[Mick]

[-- Attachment #1: Type: text/plain, Size: 1496 bytes --]

On Monday 06 November 2006 18:34, Michael Schreckenbauer wrote:

> Am Montag, 6. November 2006 15:09 schrieb Timothy A. Holmes:

> > As the machine built, the realtech is eth0 and the intel is eth1
> > I would like to reverse those two names, so that snort can use the
> > higher capacity card for its sniffer.  I am not quite sure where to look
> > even to begin this process.
>
> "nameif" does this.
>
> # equery b nameif
> [ Searching for file(s) nameif in *... ]
> sys-apps/net-tools-1.60-r12 (/sbin/nameif)
>
> # nameif <interface> <macaddress>

Or, if you're struggling with udev and you intend to run a slim installation 
you could also try setting it up in your /etc/conf.d/net:
======================================================
# OPTIONAL MODULES

# INTERFACE RENAMING
# There is no consistent device renaming scheme for Linux.
# The preferred way of naming devices is via the kernel module directly or
# by using udev (http://www.reactivated.net/udevrules.php)

# If you are unable to write udev rules, then we do provide a way of renaming
# the interface based on it's MAC address, but it is not optimal.
# Here is how to rename an interface whose MAC address is 00:11:22:33:44:55
# to foo1
#rename_001122334455="foo1"

# You can also do this based on current device name - although this is not
# recommended. Here we rename eth1 to foo2.
#rename_eth1="foo2"
======================================================

HTH.
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-user] Re: Changing the NIC name

[James]

Timothy A. Holmes <tholmes <at> mcaschool.net> writes:


> I have a snort server that I am building that has 2 nics in it
> One is a 10/100 realtec
> The other is a 10/100/1000 Intel Pro1000
> As the machine built, the realtech is eth0 and the intel is eth1
> 
> I would like to reverse those two names, so that snort can use the
> higher capacity card for its sniffer.  I am not quite sure where to look
> even to begin this process.

Hello Timothy,

I had a similar need. In fact which nic(of the 4 nics) was labled with
eth0-eth3 was inconsistent upon reboot. 

So I used the mac_eth statements like so:

mac_eth0="00:50:DA:31:31:AB"
iface_eth0="192.168.14.220 broadcast 192.168.14.255 netmask 255.255.255.0"

and so on for each nic.

This syntax has not been updated with the recent changes, but it
works splendidly for nailing down a given ip to a give ethernet mac
the /etc/conf.d/net.example file should contain the latest
syntax on how to nail down a desired IP with the mac address.


hth,


James



-- 
gentoo-user@gentoo.org mailing list