[Snort-users] two interfaces?
paul at ...6438...
Wed Sep 25 12:25:29 EDT 2002
I might be wrong but I think that if you want to run with different
rules on each interface, you will need to run two separate instances.
IMHO, two separate instances is probably a better way to go.
Daniel Curry wrote:
> Which is better?
> Having one snort daemon run with two "-i" option
> or have multiple snort daemon with one "-i" option?
> We would like to monitor two promiscuous interface.
More information about the Snort-users