Re: Different bpf filter for every multiple config used in snort

["C. L. Martinez" <carlopmart () gmail com>]

On Sun, May 19, 2013 at 7:01 PM, Russ Combs <rcombs () sourcefire com> wrote:
> On Sun, May 19, 2013 at 2:04 PM, C. L. Martinez <carlopmart () gmail com> wrote:
> > On Fri, May 17, 2013 at 7:12 PM, Eoin Miller
> > <eoin.miller () trojanedbinaries com> wrote:
> > > On 5/17/2013 15:09, C. L. Martinez wrote:
> > > > Hi all,
> > > >
> > > >  Is it possible to use one bpf filter config file for every multiple
> > > > config in snort 2.9.4.6?
> > > >
> > > > Thanks.
> > >
> > > I always created a skeleton conf file and the custom conf file that I
> > > would call when starting the process.
> > >
> > >
> > > snort -c /etc/snort/customized_snort.conf
> > >
> > >
> > > And then inside of customized_snort.conf you can have:
> > >
> > > include /etc/snort/skelton_snort.conf
> > >
> > >
> > >
> > > That way you just put in the variables that change for your instances
> > > you are running in the small conf and don't have to edit the N-number of
> > > conf's every time to setup something different.
> > >
> > > -- Eoin
> >
> > Thanks Eoin, but this doesn't solves how can I assign a bpf filter for
> > every multiple snort config file ...
>
> That actually can't be done.  The BPF is handled by the DAQ, and there
> is only one per Snort.  So the BPF file can be configured just once
> either on the command line or in the default conf.  If you run
> multiple Snort instances, then you can give each instance a different
> BPF.
> >

Thanks Russ ... But, could be a good feature to be included in next
snort relesases??

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!