re: Snort 1.9.1 Dual Sensor

["Michael J. McCasland" <mjm () nycap rr com>]

Setting up snort on two nics is rather simple:
For example:
snort -i eth1 -c /etc/snort/rules1/snort.conf
snort -i eth2 -c /etc/snort/rules2/snort.com

You also do not need to bind any IPaddress to the NICS used for snorting.

Keep your snort.conf files and all related rules seperate.
You can modify the snortd startup script to do the same. I currently run 
snort at many sites using up to three sensors on a box watching 
different segments with tailored to fit rules and an aditional NIC set 
up with an IP. IDSpolicymgr is a great help in maintaining many sensors.
I also log to Postgres and use ACID for data analysis.

-mike mccasland




-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open! 
Get cracking and register here for some mind boggling fun and 
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users