RE: Snorting on 2 interfaces

["Harper, Patrick" <patrick.harper () phns com>]

It has been discussed on this list many many times.

http://www.google.com/search?sourceid=navclient&ie=UTF-8&oe=UTF-8&q=run+
snort+two+interfaces

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=run+snort+multipl
e+interfaces

Patrick S. Harper | CISSP RHCT MCSE
Information Security Engineer
patrick.harper () phns com 



> _____________________________________________ 
> From:         snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net]  On Behalf Of Conan
> the Librarian
> Sent: Saturday, April 17, 2004 1:26 PM
> To:   snort-users () lists sourceforge net
> Subject:      [Snort-users] Snorting on 2 interfaces
>
> Hello all,
>
> Need a little help here configuring snort to sniff on two interfaces
> simultaneously in a low traffic environment. 
>
> Tried editing /etc/init.d/snort config file with IFACE=eth0,eth1 then
> IFACE=[eth0,eth1] then two separate lines of IFACE=eth0 and IFACE=eth1
> all with no joy. Read Beale, Foster and Posluns' book cover to cover.
> Checked man pages. Searched archives. All have HINTS that it can be
> done but no one specifies the syntax of the initiation or conf file.
>
> Anyone done this before?
>
> MJ
>
>  << File: ATT32167.txt >> 



Disclaimer:
This electronic message, including any attachments, is confidential and intended solely for use of the intended 
recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by 
applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have 
received this message in error, please delete it and notify the sender immediately.