Re: Different bpf filter for every multiple config used in snort

[Russ Combs <rcombs () sourcefire com>]

On Sun, May 19, 2013 at 2:04 PM, C. L. Martinez <carlopmart () gmail com> wrote:
> On Fri, May 17, 2013 at 7:12 PM, Eoin Miller
> <eoin.miller () trojanedbinaries com> wrote:
> > On 5/17/2013 15:09, C. L. Martinez wrote:
> > > Hi all,
> > >
> > >  Is it possible to use one bpf filter config file for every multiple
> > > config in snort 2.9.4.6?
> > >
> > > Thanks.
> >
> > I always created a skeleton conf file and the custom conf file that I
> > would call when starting the process.
> >
> >
> > snort -c /etc/snort/customized_snort.conf
> >
> >
> > And then inside of customized_snort.conf you can have:
> >
> > include /etc/snort/skelton_snort.conf
> >
> >
> >
> > That way you just put in the variables that change for your instances
> > you are running in the small conf and don't have to edit the N-number of
> > conf's every time to setup something different.
> >
> > -- Eoin
>
> Thanks Eoin, but this doesn't solves how can I assign a bpf filter for
> every multiple snort config file ...

That actually can't be done.  The BPF is handled by the DAQ, and there
is only one per Snort.  So the BPF file can be configured just once
either on the command line or in the default conf.  If you run
multiple Snort instances, then you can give each instance a different
BPF.
> ------------------------------------------------------------------------------
> AlienVault Unified Security Management (USM) platform delivers complete
> security visibility with the essential security capabilities. Easily and
> efficiently configure, manage, and operate all of your security controls
> from a single console and one unified framework. Download a free trial.
> http://p.sf.net/sfu/alienvault_d2d
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!