RE: Running 2 instances of snort

["Michael Steele" <michaels () silicondefense com>]

Archer,

You could do this by running the second instance from a script, but why
do you want to run 2 instances of Snort? You have 2 cards, why don't you
run Snort in promiscuous mode on one interface and use the other
interface for management console. That's what I do.

If you really want to do this, here is a link to some documentation on
our site that tells how to do this. Let me say that this documentation
is outdated, but should give you an idea of how to do what you want to
do.

http://www.silicondefense.com/techsupport/winsnortisa.htm

Michael Steele | System Engineer / System Administrator     
mailto:michaels () silicondefense com
http://www.silicondefense.com


-----Original Message-----
From: Archer [mailto:archer () ironcomet com] 
Sent: June 14, 2002 9:30 AM
To: michaels () silicondefense com
Subject: Running 2 instances of snort

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

First let me say that your tutorials are spot on.  I was really
impressed
with the detail of the guides.

I do have one question for you, if you have a moment. 

I decided I was going to run 2 copies of Snort on the same box. I have 2
NICs in it. I got the first one up and running without a hitch. For the
second, I changes c:\snort to c:\snort2 and followed the guide from
there.
Everything went fine except have 2 services of snort installed. Is there
a
way 2 have two separate snort services running at the same time?
Everything
else seems to work fine. Both snorts will capture data and send to
MySQL. 

I tried to clone the other copy of snort in the registry, but this did
not
seem to work. 

Any input on this would be appreciated.

Thank you.

Archer



- ---------------------------------------------------------------------
The information in this email is confidential and is intended solely
for the addressee(s). If you are not the intended recipient, be 
advised that you have received this email in error and that any 
use,dissemination,forwarding, printing, or copying of this email is 
strictly prohibited. If you have received this email in error 
please contact the sender.
- ---------------------------------------------------------------------
To receive my PGP key, send a blank email to the following address-
archer-pgp () ironcomet com -

-----BEGIN PGP SIGNATURE-----
Version: 6.5.8ckt http://www.ipgpp.com/

iQIVAwUBPQoaFBhauNe7Y4xFAQpr2g//VUl1BqPzxRrDivseF3SNtmMjVwibDq4Z
fxx6vW2tqW7KdbQAFe92b7Vz+MVMa9FQkAin8uoc6SWdmyxpZ41pgtz73Yju46GX
Tm8pPmdhgwu/XO6aibd/rVtGfIrcKETr6lGUesUYj1gosTJtpS9BydqUeHQWtWVI
Z6ZBdA/yfrJ3VamzpfYr7nKNDaZiR7AFmzn0ufzRr+475fPzDAvuGtFlaTjn1+1F
Dn4LEEgycH13cKTGD1TIwCamfqjogu8QlSWrJ6fj+ac8sroBfrBPPtlNcRi8wpnZ
hHqUCoEzs2JONKW2czjyBfmYZCHQkp6KroygYvPFyc6XCyPeeemxywZq7dytFs11
XPZhnIXn94xbUfFlgjWJLTlGw+Ma9Abs32Orbl9ymkv0W2pIhChs1tptLNx3BS3H
IBumon6fKUv8oFz6AnUxqxpCz0jbwPeRva0/lwwGP6dYloagPbaOqPweHDyWIRa/
Qsna2G7NwuYLkzsB45kHMXm9Rx/hiY3dimEyIdt/Pad9/03bjaiFyyINERicVWVm
/DOWED5qqiE+wtMTwUoF59IJUBRXg0zVsYMmGtF/1N9EEDi3USJyJHDKfFYxKRR4
fgh4x2p+xqLXQANwlQIG4Ch4P0E0jTSoasYas8z+fvbnkzWxfhcEg9m95Mg36au+
PXgBVnT09f0=
=QE5K
-----END PGP SIGNATURE-----









_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas - http://devcon.sprintpcs.com/adp/index.cfm?source=osdntextlink

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users