Snort mailing list archives
Re: how to specify collecting packets on more then one interface
From: Russ Combs <rcombs () sourcefire com>
Date: Wed, 9 Oct 2013 11:44:58 -0400
Please post to snort-users. You will likely find someone who has done exactly that. Thanks Russ On Tue, Oct 8, 2013 at 1:47 PM, <snorty () cad webatu com> wrote:
I have a sensor setup that currently is running as a read-only, and the tap point is split into upstream on one interface and downstream packets on another interface. My question is how can I set this up so that snort can merge the packets from just these two interfaces so snort can see the whole picture on what’s happening on the tap? (FWIW I also can't listen on all interfaces because I don’t want to look at loopback data or the other interfaces on the computer). ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- how to specify collecting packets on more then one interface snorty (Oct 08)
- Re: how to specify collecting packets on more then one interface Russ Combs (Oct 09)
- <Possible follow-ups>
- how to specify collecting packets on more then one interface snorty (Oct 11)
- Re: how to specify collecting packets on more then one interface James Lay (Oct 11)