Snort mailing list archives

Re: Win32 - multiple interfaces?


From: Rich Adamson <radamson () routers com>
Date: Thu, 1 Jan 2004 15:09:03 -0600

Hi Scot,

Thanks Mike..

Q1: You can't detect two interfaces with one Snort instance.

Note: Throw some more RAM in and run 2 Snorts

I'm going to set up one instance to run as a Service. Are your
instructions
at your site now?

When that's all done, looks like I'll take another run at updating
the README.WIN32 stuff. Been a few changes since I wrote that original
one. :)

Rich

<snip>

How about running both instances as a service?

Here is a recommendation:

Use instsrv.exe and srvany.exe from the NT Resource kit

Step-1, execute the following commands:

instsrv srvany %windir%\srvany.exe
instsrv snort1 %windir%\srvany.exe
instsrv snort2 %windir%\srvany.exe

Step-2, build two .reg files for each snort instance and import them into
the registry:
(You will have to fill in the %%'s with your own values)

Wouldn't it actually be easier to have a snort1.exe and snort2.exe and
config both to run as a Service? (I haven't tried this, so not sure it
would actually work.)

Rich




-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: