Here is the situation :
- VMplayer with 2 physical NICs (network interface cards) on the Windows host
- VM Debian 64bits
- On VM settings: both NICs are configured to replicate on the physical network
- When VM Debian is running, I declared 2 NICs :

ETH0 : (dedicated to snort)
ETH1 : set on dhcp (internet)

ETH0 is up and in promiscuous mode to receive mirroring flow from a switch
ETH1 is using to go to internet

I have some update scripts that must download some data from internet.
They cannot access the network, even if /etc/resolv.conf is well configured.

Depending tests that I did :
Or I can go to the net, but no capture on snort that listens eth0
Or I cannot go to the internet and snort capture eth0

What is(are) the configuration you think ?

I wish :

ETH0 : : capture the traffic that arriving
ETH1 : dhcp : go to the internet from kernel (root) login for my scripts

Thanks for your help


You need to make sure the default route is via the eth1 interface. For example:

route del default
route add default eth1

That will delete the existing default route (if any) and add a new default route via eth1.

You could add those as post-up commands to the definition of eth1 in /etc/network/interfaces. e.g.

iface eth1 inet dhcp
post-up route del default || true
post-up route add default eth1

The || true ensures that the route del default never returns a failure exit code, even if there is no default route to delete. Without that, ifup could abort before running the route add default eth1 command.


The problem came because VMPlayer needs to have a bridge nic and a nat bridge. After this, linux configuration interfaces are as usual.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.