Re: running snort on multiple interfaces (OpenBSD)

["CS Lee" <geek00l () gmail com>]

Soner,

If you are in bridge mode, sniffing on one of the interface should be enough
as any of the interface should see all the traffics. So that doesn't matter.

And it is fine that bridge has no IP and snort will still work.

We need to know more about your setup, it's a bit unclear, I'm wondering why
you should configure IP for the network interfaces.

On 4/9/07, Soner Tari <list () kulustur org> wrote:
> Hi,
>
> I need to run snort on multiple interfaces. Currently, I'm running
> multiple snort instances to achieve this, but this stretches the shared
> memory.
>
> I've read FAQ 3.6, where it reads I should use a bridge interface on
> *BSD systems. I've tried that advice by creating bridge0, adding
> physical interfaces to it, upping it (per the brconfig(8) examples), and
> finally starting snort with "-i bridge0" argument. Snort starts (though,
> complaining that bridge0 is not assigned any IPs), but I cannot see any
> alerts.
>
> Otherwise, I use nmap to trigger alerts, and I can generate alerts very
> easily by providing snort with, say, "-i vr0".
>
> In order to clarify what I did, I need to assign IPs to all of the
> physical interfaces, thus I cannot follow the examples in brconfig(8)
> verbatim.
>
> Do I need to do anything else, or am I missing something? How do I
> achieve "any" interface on OpenBSD?
>
> I would appreciate any help,
> Thanks,
>
>
>
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share
> your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



--
Best Regards,

CS Lee<geekooL[at]gmail.com>

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users