Snort mailing list archives
how to specify collecting packets on more then one interface
From: <snorty () cad webatu com>
Date: Tue, 08 Oct 2013 13:47:52 -0400
I have a sensor setup that currently is running as a read-only, and the tap point is split into upstream on one interface and downstream packets on another interface. My question is how can I set this up so that snort can merge the packets from just these two interfaces so snort can see the whole picture on what's happening on the tap? (FWIW I also can't listen on all interfaces because I don't want to look at loopback data or the other interfaces on the computer).
------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- how to specify collecting packets on more then one interface snorty (Oct 08)
- Re: how to specify collecting packets on more then one interface Russ Combs (Oct 09)
- <Possible follow-ups>
- how to specify collecting packets on more then one interface snorty (Oct 11)
- Re: how to specify collecting packets on more then one interface James Lay (Oct 11)