Snort mailing list archives
Re: Snort with two sniffing interfaces
From: Joel Esler <jesler () sourcefire com>
Date: Thu, 20 May 2010 09:44:49 -0400
On May 20, 2010, at 3:24 AM, Edward Bjarte Fjellskål wrote:
Crook, Parker wrote:Either run two instances: /snort/snort -D -N -i eth0 -c /snort/conf/snort.conf /snort/snort -D -N -i eth1 -c /snort/conf/snort.conf or bond the interfaces: /snort/snort -D -N -i bond0 -c /snort/conf/snort.conf Personally I run two instances because I have two logically different environments I am sniffing and want/need to run two different configs; if I didn’t have this need I would probably go the bonded route.Hi, I Just wanted to add the little talked about feature of snort, where you can define virtual networks, example: config binding: /etc/snort/vips/snort-0.conf net 192.168.0.0/24 config binding: /etc/snort/vips/snort-1.conf net 192.168.1.0/24 config binding: /etc/snort/vips/snort-2.conf net 192.168.2.0/24 So, you have a default /etc/snort/snort.conf and configure that as a fall-back configuration (Catch all traffic not handled by your virtual configs) and then add the statements above. You can then configure snort-0.conf, snort-1.conf, snort-2.conf to handle their respective traffic (Variables, rules, preprocessors etc). In this case, if you have: 192.168.0.0/24 on eth1 192.168.1.0/24 on eth2 192.168.2.0/24 on eth3 you would need to bond them together and have snort listen on the bonded interface. My gut feelings are that there are some performance and memory benefits firing up one instance of snort configured with virtual-networks, then firing up X instances of snort, but I have not done any tests. *I would like to hear thoughts from other playing with this feature* Best regards, Edward Fjellskål
As an added note, you can also do virtual binding by VLAN as well. I encourage those of you that are interested in this feature (which is great, I've used it several times at several different installations already), to check out README.multipleconfigs in the doc/ directory of the Snort Tarball. -- Joel Esler ------------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort with two sniffing interfaces Alejandro Cabrera Obed (May 11)
- <Possible follow-ups>
- Snort with two sniffing interfaces Alejandro Cabrera Obed (May 11)
- Re: Snort with two sniffing interfaces Max Williams (May 11)
- Re: Snort with two sniffing interfaces Jason Wallace (May 11)
- Re: Snort with two sniffing interfaces Seth Art (May 11)
- Re: Snort with two sniffing interfaces Joel Esler (May 11)
- Re: Snort with two sniffing interfaces Alejandro Cabrera Obed (May 14)
- Re: Snort with two sniffing interfaces Max Williams (May 11)
- Re: Snort with two sniffing interfaces Crook, Parker (May 18)
- Re: Snort with two sniffing interfaces Edward Bjarte Fjellskål (May 20)
- Re: Snort with two sniffing interfaces Joel Esler (May 20)