Re: How to monitor two different traffics with snort

[Sandro guly Zaccarini <guly () luv guly org>]

On Fri, Jun 05, 2009 at 10:29:17AM -0400, Nigel Houghton wrote:
> On Fri, Jun 5, 2009 at 10:10 AM, Luis Daniel Lucio
> > Wait to 2.8.5 it has multi-iface capabilities.
>
> Here's a better idea:
>
> Two interfaces on the snort box, one connected to one side of the
> firewall and the other to the inside of the firewall. Then start two
> instances of snort, one per interface.

so you are saying that multi-interface doesn't work very well?

sz

-- 
  /"\   taste your favourite sysadmin 
  \ /   gpg public key http://www.guly.org/guly.asc
   X    
  / \

Attachment: smime.p7s
Description:

------------------------------------------------------------------------------
OpenSolaris 2009.06 is a cutting edge operating system for enterprises 
looking to deploy the next generation of Solaris that includes the latest 
innovations from Sun and the OpenSource community. Download a copy and 
enjoy capabilities such as Networking, Storage and Virtualization. 
Go to: http://p.sf.net/sfu/opensolaris-get

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users