[Snort-users] two interfaces?

Erek Adams erek at ...577...
Mon Sep 23 14:05:04 EDT 2002

On Mon, 23 Sep 2002, Daniel Curry wrote:

>   Which is better?
> Having one snort daemon run with two "-i" option
> or have multiple snort daemon with one "-i" option?
>  We would like to monitor two promiscuous interface.

You can't use multiple -i statements and have snort sniff two interfaces.  If
you are using Linux kernel 2.3+ you can use the '-i any' instead.  Otherwise,
use two instances.

Erek Adams

More information about the Snort-users mailing list