[Snort-users] one snort sensor, two networks

Frank Knobbe FKnobbe at ...649...
Wed Sep 26 09:02:06 EDT 2001


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> -----Original Message-----
> From: Steve Moran [mailto:steve.moran at ...2661...]
> Sent: Wednesday, September 26, 2001 10:05 AM
> 
> is it possible to run snort on two interfaces within the same 
> box at the
> same time, without running two processes?		       	
> net2----	snort box ---- net1


No, you need two processes. Two different snort configs. Even if PCap
would allow for a combined scan, why would you run it in only one
process? Don't you want to customize your rules and snort config
depending on the networks?

Regards,
Frank

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.8
Comment: PGP or S/MIME (X.509) encrypted email preferred.

iQA/AwUBO7H755ytSsEygtEFEQKmLQCfbZkv/Y2x1FygyJN5y2/r0P543hUAoKcQ
TiQbWyktpYJNcs6f8nijqScC
=a4fF
-----END PGP SIGNATURE-----




More information about the Snort-users mailing list