If you’ve got a bad memory (like me) you might some day find yourself searching for a way to configure an interface on your Ubuntu 9.04 system to use as a sniffer interface. Here is how you do it:

1) Edit the interfaces file:

you@ubuntu:~$ sudo vim /etc/network/interfaces
[sudo] password for you: enter your password

2) Go to the last line of your interfaces file and add the following:

iface eth1 inet manual
up ifconfig $IFACE 0.0.0.0 up
up ip link set $IFACE promisc on
down ip link set $IFACE promisc off
down ifconfig $IFACE down

3) Save and exit the file:

:wq

4) Bring your newly configured interface up:

you@ubuntu:~$ sudo ifup eth1


5) Check your interface and look for PROMISC:

you@ubuntu:~$ sudo ifconfig eth1
eth1 Link encap:Ethernet HWaddr 00:0c:29:bb:3a:cc
inet6 addr: fe80::20c:29ff:febb:3acc/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:31011 errors:0 dropped:0 overruns:0 frame:0
TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4973602 (4.9 MB) TX bytes:796 (796.0 B)
Interrupt:16 Base address:0x2080

Now start snort, tcpdump, or whatever you want to use to start sniffing traffic using your newly configured promiscuous interface.