[Snort-users] snort on multiple interfaces

Rick Francis rfrancis at ...468...
Tue Jan 16 21:43:15 EST 2001

this did not work, in fact, snort failed to start altogether.
albeit the interfaces in this box are subnets of one another cut-up by
netmask...if that makes a difference to snort?

-----Original Message-----
From: roesch [mailto:roesch]On Behalf Of Martin Roesch
Sent: Friday, January 12, 2001 11:18 AM
To: Rick Francis
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] snort on multiple interfaces

Hi Rick,
     You can't add other network interfaces, but you can specify other
networks like this:

var HOME_NET [a.b.c.d/25,w.x.y.z/24]

Try that.


Rick Francis wrote:
> preprocessor portscan: a.b.c.d/25 3 5 /var/log/snort.alert
> var HOME_NET a.b.c.d./25
> how can i add other networks/interfaces to these lines for snort to watch?
> rf
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users

More information about the Snort-users mailing list