[Snort-users] running 2 instances of snort under Demarc

SkatFiend at ...661... SkatFiend at ...661...
Thu May 23 07:01:04 EDT 2002


To all of you who may be interested I did inquire of Demarc and here is the 
answer:

Question:

Win2K & Demarc v1.6 server, with a multi-homed box, how can I get Demarc to 
run 2 instances of snort at the same time, one for each NIC interface both 
writing to the local mysql database and reporting to Demarc

Response:

This is not possible with the current build due to the limitations of running 
them as Windows services.  There will be an update build that will be 
available on Friday that will allow you to do this though.  Please redownload 
the program on Friday of this week and there will be instructions inside the 
psd.conf (Sensor configuration file) on how to do accomplish this.

------------------------------------------------------------------------------

--------------------------------------------
I talked to demarc a little while back and they said that they are thinking 
about finding a way to be able to have demarc start up snort on 2 interfaces. 
If you want to watch all interfaces, you can start one instance of snort with 
out a -i option (or is it -i any) and snort will bind to all interfaces. 
 
I would send demarc an email and see what they have done.
 
Ian

> ----- Original Message ----- 
> From: <A HREF="mailto:SkatFiend at ...661...">SkatFiend at ...661...</A> 
> To: <A HREF="mailto:snort-users at lists.sourceforge.net">snort-users at lists.sourceforge.net</A> 
> Sent: Friday, May 17, 2002 3:17 PM
> Subject: [Snort-users] running 2 instances of snort under Demarc
> 
> 
> OK ok ooookkkk, I know this is the snort user list but a lot of folks here 
> use Demarc also and I realy need an answer to this if anyone can help.
> 
> OK, running Demarc v1.6 in a Win2K platform. If I have a multi-homed box 
> with 2 NIC cards running the Demarc v1.6 server with a local MySql database 
> can I run two instances of snort at once so I can sniff each of the 
> interfaces at the same time???
> 
> I know this may not be advisable, and could end up taking a CPU pounding.
> 
> Answers are appreciated. Thanks, Cliff 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020523/5da165cd/attachment.html>


More information about the Snort-users mailing list