[Snort-users] Multiple "sniffing" interfaces
funky at ...8796...
Thu Jul 24 00:38:04 EDT 2003
There is a patch for libpcap that you can define "any" as interface, which
means all of the interfaces. Maybe this speciality interests your client:)
On Wed, 23 Jul 2003, Bryan Miller wrote:
> I was curious as to the list member's experiences with using multiple
> interfaces in "sniffing" mode. We have a client who insists that we
> install multiple NIC's in our box instead of purchasing another
> appliance. I was wondering how this affects other add-ins such as ACID,
> SnortCenter and SnortSAM. If anyone has any experiences with running
> multiple NIC's in this fashion, I'd love to hear from you. I'm also
> guessing that you would have to run multiple instances of Snort?
More information about the Snort-users