Snort mailing list archives
Re: listening on two interfaces (Ronneil Camara)
From: "Joe Pampel" <joe () ardsley com>
Date: Wed, 06 Feb 2002 21:50:19 -0500
Absolutely. just run 2 instances.. For ex, in windows, just open 2 DOS boxes.. run the same command line (or different ones, for different snort.conf perhaps?) use different command lines that specify which interface to run against, eg: box one has..
snort -c c:\snort\snort.conf -l c:\snort\logs -i1
box two has
snort -c c:\snort\snort2.conf -l snort\logs -i2
etc etc. Add cards until you run out of PCI slots.. They can all log to ACID and it will know how many sensors you have and you can review the alerts by sensor etc. If this machine is on more than 1 net, be sure to use a "read only" cable on at least one interface (if not both.. see the FAQ) hth Joe _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: listening on two interfaces (Ronneil Camara) Joe Pampel (Feb 06)