[Snort-users] Multiple interfaces

Chris Schuler cschuler at ...1139...
Sun Jan 14 14:42:15 EST 2001

I installed lipbcap 0.6.1 and rebuilt snort and i get

eye:~/snort-1.7# snort -i any -c /etc/snort/snortnoicmp.conf

        --== Initializing Snort ==--

Initializing Network Interface any
ioctl(SIOCGIFMTU): No such device
ERROR: Can not get MTU of an interface any!

I am assuming that is where you meant for me to specify 'any' as the

-----Original Message-----
From: Denis Ducamp [mailto:Denis.Ducamp at ...199...]
Sent: Sunday, January 14, 2001 1:24 PM
To: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Multiple interfaces

On Sat, Jan 13, 2001 at 04:55:55PM -0500, Chris Schuler wrote:
> Running snort 1.7 on a Linux box, is there a way for once instance of
> to monitor multiple interfaces?

Use a very recent version of libpcap and specify "any" as interface to
listen to all interfaces at the same time.

> I searched the archives for a few minutes but didn't see a definitive
> answer.
> It seems like it would be able to, with the wording in the README file for
> -I and what not.. .

But this is the FAQ ;-) look at http://www.snort.org/writing_snort_rules.htm

For french speakers, look at my translation on
Other documentations, as the manual, are a work in progress.

Denis Ducamp.

 Denis.Ducamp at ...199... --- Hervé Schauer Consultants --- http://www.hsc.fr/
snort, hping & dsniff en français : http://www.groar.org/~ducamp/#sec-trad
 Du bon usage de ... http://usenet-fr.news.eu.org/fr-chartes/rfc1855.html
  Netiquette Guidelines .... http://www.pasteur.fr/infosci/RFC/18xx/1855

Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:

More information about the Snort-users mailing list