Snort mailing list archives
Re: running snort on multiple interfaces (OpenBSD)
From: "CS Lee" <geek00l () gmail com>
Date: Sat, 14 Apr 2007 11:47:28 +0800
Soner, If you are in bridge mode, sniffing on one of the interface should be enough as any of the interface should see all the traffics. So that doesn't matter. And it is fine that bridge has no IP and snort will still work. We need to know more about your setup, it's a bit unclear, I'm wondering why you should configure IP for the network interfaces. On 4/9/07, Soner Tari <list () kulustur org> wrote:
Hi, I need to run snort on multiple interfaces. Currently, I'm running multiple snort instances to achieve this, but this stretches the shared memory. I've read FAQ 3.6, where it reads I should use a bridge interface on *BSD systems. I've tried that advice by creating bridge0, adding physical interfaces to it, upping it (per the brconfig(8) examples), and finally starting snort with "-i bridge0" argument. Snort starts (though, complaining that bridge0 is not assigned any IPs), but I cannot see any alerts. Otherwise, I use nmap to trigger alerts, and I can generate alerts very easily by providing snort with, say, "-i vr0". In order to clarify what I did, I need to assign IPs to all of the physical interfaces, thus I cannot follow the examples in brconfig(8) verbatim. Do I need to do anything else, or am I missing something? How do I achieve "any" interface on OpenBSD? I would appreciate any help, Thanks, ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- Best Regards, CS Lee<geekooL[at]gmail.com>
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- running snort on multiple interfaces (OpenBSD) Soner Tari (Apr 09)
- Re: running snort on multiple interfaces (OpenBSD) Joe (Apr 13)
- Re: running snort on multiple interfaces (OpenBSD) CS Lee (Apr 13)