[Snort-users] Getting One instance of snort to sniff 2 interf aces

Tom Sevy tsevy at ...1701...
Thu May 3 07:21:21 EDT 2001


So with interface *any*, does anyone's os (kernel) complain about seeing the
same MAC on multiple interfaces?  This is what happens when you sniff with
multiple interfaces on the same segment in a *switched* environment, as the
packet originates on one switch and is seen by one of snort's interfaces,
and the packet's destination is on the same segment but on a different
switch.





More information about the Snort-users mailing list