Re: How to monitor two different traffics with snort

[Nigel Houghton <nhoughton () sourcefire com>]

On Fri, Jun 5, 2009 at 11:27 AM, Sandro guly Zaccarini<guly () luv guly org> wrote:
> On Fri, Jun 05, 2009 at 10:29:17AM -0400, Nigel Houghton wrote:
> > On Fri, Jun 5, 2009 at 10:10 AM, Luis Daniel Lucio
> > > Wait to 2.8.5 it has multi-iface capabilities.
> >
> > Here's a better idea:
> >
> > Two interfaces on the snort box, one connected to one side of the
> > firewall and the other to the inside of the firewall. Then start two
> > instances of snort, one per interface.
>
> so you are saying that multi-interface doesn't work very well?

Nope, I'm saying that given his scenario, two instances are probably better.

-- 
Nigel Houghton
Head Mentalist
SF VRT
http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/

------------------------------------------------------------------------------
OpenSolaris 2009.06 is a cutting edge operating system for enterprises 
looking to deploy the next generation of Solaris that includes the latest 
innovations from Sun and the OpenSource community. Download a copy and 
enjoy capabilities such as Networking, Storage and Virtualization. 
Go to: http://p.sf.net/sfu/opensolaris-get
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users