[Snort-users] multiple interfaces on a Snort sensor

francesco friscom at ...2470...
Tue May 27 07:02:33 EDT 2003


In the near past (March 11-13) there were a couple of threads about the 
possibility to use multiple interfaces on a sensor, to collect alerts and 
logs from multiple sources.
One possible use could be a sensor interface before the firewall and one 
placed elsewhere, behind it.

Normally the outside interface should be configured in stealth mode, in 
order to avoid  (as much as possible) its detection from malicious sources.

The dual interface is supported (though not recommended, I understand, by 
some people who replied to the original message) by inserting the option:
	-i any
on the command line.

This configuration works also if you have a stealth mode interface, i.e. , 
you do not get error messages when you run the process but it seems that 
the logs and the alert are not from the two interfaces but only from the 
interface having the IP address.

I tried this with version 1.9.1, so I cannot confirm whether version 2.0.x 
has a different behavior.

I wish to read some comments from those who also experimented such 
configuration, that in my humble opinion could work fine (no significant 
packet loss) with some good quality ethernet cards and a fast (current) PC.





More information about the Snort-users mailing list