[Snort-users] Multiple "sniffing" interfaces

Derya Sezen funky at ...8796...
Thu Jul 24 00:38:04 EDT 2003


There is a patch for libpcap that you can define "any" as interface, which 
means all of the interfaces. Maybe this speciality interests your client:)

On Wed, 23 Jul 2003, Bryan Miller wrote:

> I was curious as to the list member's experiences with using multiple
> interfaces in "sniffing" mode.  We have a client who insists that we
> install multiple NIC's in our box instead of purchasing another
> appliance.  I was wondering how this affects other add-ins such as ACID,
> SnortCenter and SnortSAM.  If anyone has any experiences with running
> multiple NIC's in this fashion, I'd love to hear from you.  I'm also
> guessing that you would have to run multiple instances of Snort?
> 
> Bryan
> 





More information about the Snort-users mailing list