Snort mailing list archives
Re: Snort on multiple interfaces
From: Martin Olsson <elof () sentor se>
Date: Wed, 19 Nov 2003 18:58:24 +0100 (CET)
On Wed, 19 Nov 2003, STEPHEN W. COREY - 5535 wrote:
If I configure Snort on multiple interfaces (either by the libpcap method, or the -i method), will snort report the data as coming from 2 different sensors? This is the effect I'm hoping to achieve, anyways.
I run three snort processes on the same nic and two snorts on another nic. All of the log to MySQL, and each process is displayed as a unique sensor. snort blahblah -i eth0 blahblah net 10.0.0.0/8 snort blahblah -i eth0 blahblah net 172.22.0.0/16 snort blahblah -i eth0 blahblah net 192.168.0.0/16 snort blahblah -i eth1 blahblah net 172.16.0.0/16 snort blahblah -i eth1 blahblah net 172.20.0.0/16 ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort on multiple interfaces STEPHEN W. COREY - 5535 (Nov 19)
- Re: Snort on multiple interfaces Martin Olsson (Nov 19)