AW: Some questions about snort

["Poppi, Sandro" <Sandro.Poppi () wacker com>]

> > - Is it possible with snort to sniff on 2 or more network 
> cards with only
> > one instance of the snort's daemon? (in order to monitor 2 
> or more segments
> > of a network with only one snort)
>
> No.
Well, I would say directly not but using channel bonding (assuming linux,
don't now about *bsd) you can combine two or more physical nics to one
logical (i.e. bond0) which I use e.g. in combination with ethernet taps to
recombine streams. It works fine.

Take a look at http://sourceforge.net/projects/bonding.

OTOH I use 5 instances of snort on one box with 5 "snorted" nics and I think
I get a better performance instead of using bonding of the 5 nics (no taps
incorporated on that box).

HTH,
Sandro

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users