[Snort-users] Two Ethernet Interfaces?

Peter Param pparam at ...7379...
Mon Nov 4 14:43:06 EST 2002

Not really,  you should be able to run off a single nic quite nicely -
if the combined traffic on switched port is not more than what your lan
card can take.  You should also be able to snort off several nics if you
have several segments.



>>> "Mike Koponick" <mike at ...7385...> 11/05/02 09:28 AM >>>
I was wondering if it was absolutely necessary to have TWO ethernet
interfaces for the Snort sensor? Is this done for security or
issues? I would think that if you had one interface it would work fine
there wasn't a lot of traffic. However, I would like to run in promisc
as I could "catch" more traffic that way, so I would assume if you
wanted to
run in promisc mode you would have to have two ethernet interfaces,

Thanks in advance for you help.


This SF.net email is sponsored by: ApacheCon, November 18-21 in
Las Vegas (supported by COMDEX), the only Apache event to be
fully supported by the ASF. http://www.apachecon.com
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been
virus scanned and although no viruses were detected by the system,
St Vincent's Hospital accepts no liability for any consequential
damage resulting from email containing any computer viruses.


More information about the Snort-users mailing list