Re: Snort Install for monitoring 5 interfaces?

[sEc nErD <umkcguy1978 () yahoo com>]

Hi LEon,Thanks for your reply.Ok right now i have set it up in a test lab enviornment and its listening on one 
interface.I am still not clear what i would have to do for listening on 5 different interfaces???
i have the acid up and running just not contacting the mysql database but tht i will struggle and work around,but i do 
need to understand the part for 5 interfaces...could you please detail on thzt
thanks


Leon Ward <leon () countersnipe com> wrote:
Hi
Sorry if this is a bit quick, but in a rush.

snort needs to connect to a single interface on start-up, this leaves
you with two options.
A) Have multiple snort instances running bound to each interface.
- This will allow you to customise the configuration for each, I assume
you will want to protect different things on the DMZ compared to the
internal_net
B) Team the interfaces together so you can attach snort to interface
bond0 

Take a look at the following link, it may answer a few questions (I'm a
debian man myself)
http://www.ms.washington.edu/Docs/Linux/rhel-rg-en-3/s1-networkscripts-interfaces.html#S2-NETWORKSCRIPTS-INTERFACES-CHAN


Hope the above helps.


-Leon


On Sun 2005-02-06 at 06:04 -0800, sEc nErD wrote:
> hi all,
> We ahve to install snort on a box running fedora.
> And this snort is supposed to listen on 5 interfaces 
> inside pix,outside pix and 3 dmz's.
>
> could anyone give some precautions and pointers for
> the install to be taken since its going to listen on 5
> interfaces .Right now am building the box from scratch
> by putting in network cards and installing fedora on
> it ,any precuation on that stage??
>
> thanks all in advance
>
>
>
>
>
>
>
> __________________________________ 
> Do you Yahoo!? 
> Yahoo! Mail - You care about security. So do we. 
> http://promotions.yahoo.com/new_mail
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- 



                
---------------------------------
Do you Yahoo!?
 Yahoo! Search presents - Jib Jab's 'Second Term'