Re: How to monitor two different traffics with snort

[Joel Esler <jesler () sourcefire com>]

On Fri, Jun 5, 2009 at 11:27 AM, Sandro guly Zaccarini <guly () luv guly org>wrote:

> On Fri, Jun 05, 2009 at 10:29:17AM -0400, Nigel Houghton wrote:
> > On Fri, Jun 5, 2009 at 10:10 AM, Luis Daniel Lucio
> > > Wait to 2.8.5 it has multi-iface capabilities.
> >
> > Here's a better idea:
> >
> > Two interfaces on the snort box, one connected to one side of the
> > firewall and the other to the inside of the firewall. Then start two
> > instances of snort, one per interface.
>
> so you are saying that multi-interface doesn't work very well?

I believe he asking "why are you logging outside the firewall"?  Let the
firewall do it's job and block things that are supposed to be blocked, let
your IDS analyze what is actually getting through.  What is getting through
is what you need to worry about, not what is being blocked.


-- 
joel esler | Sourcefire | gtalk: jesler () sourcefire com | 302-223-5974

------------------------------------------------------------------------------
OpenSolaris 2009.06 is a cutting edge operating system for enterprises 
looking to deploy the next generation of Solaris that includes the latest 
innovations from Sun and the OpenSource community. Download a copy and 
enjoy capabilities such as Networking, Storage and Virtualization. 
Go to: http://p.sf.net/sfu/opensolaris-get

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users