RE: Multihomed Sensor

[Dean Davis <Dean.Davis () mbg-inc com>]

Also:
 
Ensure that you have enough CPU power to handle the added load of running 4
instances of Snort. In my environment, I have 4 interfaces, but reserve 1
exclusively for management because oft-times, I've been unable to even SSH
into the interface that Snort is running on.

 

Thanks,

Dean Davis, MCSE,MCDBA,CCNA,CNA,N+,Linux+

Sr. Network Engineer

MBG, Inc.

370 Lexington Avenue

New York, NY 10017

P. 212.822.4429

F. 212.822.4499

http://www.mbg-inc.com

-----Original Message-----
From: Kreimendahl, Chad J [mailto:Chad.Kreimendahl () umb com] 
Sent: Wednesday, January 28, 2004 10:34 AM
To: snort-users () lists sourceforge net
Subject: RE: [Snort-users] Multihomed Sensor


 
You'll have to run a unique instance of snort for each interface... 

-----Original Message-----
From: mailing-list
[mailto:IMCEAEX-_O=HCC+20INSURANCE+20HOLDINGS+2C+20INC+2E_OU=HCC-HOUSTON_CN=
RECIPIENTS_CN=MAILING-LIST () USSIC com] 
Sent: Saturday, January 24, 2004 1:13 AM
To: 'snort-users () lists sourceforge net'
Subject: [Snort-users] Multihomed Sensor



I currently have a Linux box with 4 NICs.  How do I configure it so that I
can monitor each NIC separately with its own conf file?  I have different
subnets that I want to monitor. 

Thanks in Advance!