[Snort-users] Multiple interfaces

Chris Schuler cschuler at ...1139...
Sun Jan 14 14:42:15 EST 2001


I installed lipbcap 0.6.1 and rebuilt snort and i get

eye:~/snort-1.7# snort -i any -c /etc/snort/snortnoicmp.conf


        --== Initializing Snort ==--

Initializing Network Interface any
ioctl(SIOCGIFMTU): No such device
ERROR: Can not get MTU of an interface any!

I am assuming that is where you meant for me to specify 'any' as the
interface.




-----Original Message-----
From: Denis Ducamp [mailto:Denis.Ducamp at ...199...]
Sent: Sunday, January 14, 2001 1:24 PM
To: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Multiple interfaces


On Sat, Jan 13, 2001 at 04:55:55PM -0500, Chris Schuler wrote:
> Running snort 1.7 on a Linux box, is there a way for once instance of
snort
> to monitor multiple interfaces?

Use a very recent version of libpcap and specify "any" as interface to
listen to all interfaces at the same time.

> I searched the archives for a few minutes but didn't see a definitive
> answer.
> It seems like it would be able to, with the wording in the README file for
> -I and what not.. .

But this is the FAQ ;-) look at http://www.snort.org/writing_snort_rules.htm

For french speakers, look at my translation on
http://www.groar.org/~ducamp/english.html#sec-trad
Other documentations, as the manual, are a work in progress.

Denis Ducamp.

-- 
 Denis.Ducamp at ...199... --- Hervé Schauer Consultants --- http://www.hsc.fr/
snort, hping & dsniff en français : http://www.groar.org/~ducamp/#sec-trad
 Du bon usage de ... http://usenet-fr.news.eu.org/fr-chartes/rfc1855.html
  Netiquette Guidelines .... http://www.pasteur.fr/infosci/RFC/18xx/1855

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users




More information about the Snort-users mailing list