[Snort-users] two interfaces?
erek at ...577...
Mon Sep 23 14:05:04 EDT 2002
On Mon, 23 Sep 2002, Daniel Curry wrote:
> Which is better?
> Having one snort daemon run with two "-i" option
> or have multiple snort daemon with one "-i" option?
> We would like to monitor two promiscuous interface.
You can't use multiple -i statements and have snort sniff two interfaces. If
you are using Linux kernel 2.3+ you can use the '-i any' instead. Otherwise,
use two instances.
More information about the Snort-users