[Snort-users] -i any ?

McCammon, Keith Keith.McCammon at ...3497...
Tue May 14 11:47:04 EDT 2002


Incidentally, I wrote up a fast and dirty how-to on running multiple instances of Snort on FreeBSD.  There are lots of ways to do it, but this one suited my needs for rule segregation, etc.  Maybe you'll find it of interest...

<http://mccammon.org/security/snort_fbsd.htm>

Cheers

Keith

-----Original Message-----
From: Erek Adams [mailto:erek at ...577...]
Sent: Tuesday, May 14, 2002 2:30 PM
To: Jev
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] -i any ?


On Tue, 14 May 2002, Jev wrote:

> I have seen mention of using '-i any' arg with snort in order to get it
> to listen on all interfaces. I tried it on my multihomed freebsd
> 4.5-stable box (no less than 4 interfaces) and I get the following
> error.

[...snip...]

> Snort works fine when I specify one particular interface. Is the any
> keyword related to the pcap lib?
> Clarification greatly appreciated :)

http://www.snort.org/docs/faq.html#3.4

You'll need to run 4 instances.  :-/

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth at ...382...
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list