[Snort-users] two interfaces?

Paul Poh paul at ...6438...
Wed Sep 25 12:25:29 EDT 2002


I might be wrong but I think that if you want to run with different 
rules on each interface, you will need to run two separate instances. 
IMHO, two separate instances is probably a better way to go.

Daniel Curry wrote:
>   Which is better? 
> Having one snort daemon run with two "-i" option
> or have multiple snort daemon with one "-i" option?
>  We would like to monitor two promiscuous interface.
> 






More information about the Snort-users mailing list