RE: one snort sensor, two networks

[Frank Knobbe <FKnobbe () KnobbeITS com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> -----Original Message-----
> From: Steve Moran [mailto:steve.moran () csssoftware com]
> Sent: Wednesday, September 26, 2001 10:05 AM
>
> is it possible to run snort on two interfaces within the same 
> box at the
> same time, without running two processes?                     
> net2----      snort box ---- net1


No, you need two processes. Two different snort configs. Even if PCap
would allow for a combined scan, why would you run it in only one
process? Don't you want to customize your rules and snort config
depending on the networks?

Regards,
Frank

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.8
Comment: PGP or S/MIME (X.509) encrypted email preferred.

iQA/AwUBO7H755ytSsEygtEFEQKmLQCfbZkv/Y2x1FygyJN5y2/r0P543hUAoKcQ
TiQbWyktpYJNcs6f8nijqScC
=a4fF
-----END PGP SIGNATURE-----

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users