[Snort-users] Configuration issue, Part II

Chris Keladis Chris.Keladis at ...2783...
Mon Sep 24 06:21:02 EDT 2001


Chris Keladis wrote:

> DJDave Sobel wrote:
>
> > And of more importance to me, how do you specify binding to multiple
> > interfaces?  I'd like it to be watching traffic to all the internal
> > networks, not just one... (that way, I can see what ipchains missed..)
> 
> This is in the Snort FAQ, but if you run a Linux 2.4 kernel and a
> special patch to Snort, and specify '-i any' Snort will monitor all
> interfaces (not certain if this patch has found it's way into mainstream
> Snort?)

Eeep.. Sorry, the patch is for libpcap, i wrongly assumed it was for
Snort.

*Drinks more beer.. Things will look clearly soon i'm sure* :)




Cheers,

Chris.




More information about the Snort-users mailing list