FW: [Snort-users] [Snorting 2 NICs]

McCammon, Keith Keith.McCammon at ...3497...
Mon Jun 10 06:26:03 EDT 2002

Please disregard.  Works like a charm on FreeBSD with a single binary.  Damned Monday mornings...

-----Original Message-----
From: McCammon, Keith 
Sent: Monday, June 10, 2002 9:09 AM
To: 'mr6re9 at ...6025...'; snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] [Snorting 2 NICs]

You should be able to simply install another Snort instance.  Instances can share conf and rules files, but not the binary as far as I am aware.  Just do "cp snort snort2" and call snort2 for the second instance.

-----Original Message-----
From: Gregory D Hough [mailto:mr6re9 at ...6025...]
Sent: Monday, June 10, 2002 8:47 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] [Snorting 2 NICs]

Greetings Group,

I have Snort running into MySQL. I use ACID to view alerts. Snort works fine 
when started as: snort -c /usr/local/etc/snort/snort.conf -i eth0 -D but this 
is my internal interface. When fired up for eth1 (IP address ppp0) I get this 
in /var/log/messages:

WARNING: OpenPcap() device eth1 network lookup: ^Ieth1: no Ipv4 address 
Initializing daemon mode
WARNING: OpenPcap() device eth1 network lookup: ^Ieth1: no Ipv4 address 
PID stat checked out ok, PID set to /var/run
Writing PID file to "/var/run"
Snort initialization completed successfully, Snort running

Obviously Snort sees no traffic whatsoever. Is there anyway to initialize 
Snort with two sensors, eth0 and ppp0?

This is on a tutorial HOME_NET, with a Linux gateway machine and two other 
boxes inside, one Linux and one Win. I'd like to continue monitoring the 
internal due to the Win box. I have mulled over the excellent documentation 
for setting the whole thing up, thanks to everyone involved. I just haven't 
found an answer to this type of setup yet.

Thanks for any clues,

PS- Poll Contrib:

month/year of capture: 05/21/2002 to 06/10/2002

version of snort: snort-1.8.6

description of rules enabled  - default? all? custom (please give details): 

sensor environment - what kind/size of organisation, location of sensor etc: 
home network/3 boxen eth0 before hub on gateway machine

inside some kind of firewall (Y/N): Y iptables

bandwidth sniffed (ISDN, ADSL, 10, 100, gigabit etc): ADSL

duration of sniffing (days): 20

total number of alerts raised: 185

format of alerting - text/fast, text/full (this is the default), tcpdump, 
database (what type?) etc: default, MySQL-3.23.43-1

payloads captured (Y/N): Y

total disk space taken by the alerts (including payloads if captured, 
database indexes etc): 92.1 KB's


Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas - http://devcon.sprintpcs.com/adp/index.cfm?source=dntextlink

Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list