Snort mailing list archives

how to specify collecting packets on more then one interface


From: <snorty () cad webatu com>
Date: Thu, 10 Oct 2013 22:07:55 -0400



I have a sensor setup that currently is running as a read-only, and the tap
point is split into upstream on one interface and downstream packets on
another interface. My question is how can I set this up so that snort can
merge the packets from just these two interfaces so snort can see the whole
picture on what's happening on the tap? (FWIW I also can't listen on all
interfaces because I don't want to look at loopback data or the other
interfaces on the computer).
------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Current thread: