Snorting on 2 interfaces

["Conan the Librarian" <conan_the_librarian () adelphia net>]

Hello all,

Need a little help here configuring snort to sniff on two interfaces
simultaneously in a low traffic environment. 

Tried editing /etc/init.d/snort config file with IFACE=eth0,eth1 then
IFACE=[eth0,eth1] then two separate lines of IFACE=eth0 and IFACE=eth1 all
with no joy. Read Beale, Foster and Posluns' book cover to cover. Checked
man pages. Searched archives. All have HINTS that it can be done but no one
specifies the syntax of the initiation or conf file.

Anyone done this before?

MJ

<<attachment: winmail.dat>>