[Snort-users] multiple interfaces on a Snort sensor
friscom at ...2470...
Tue May 27 07:02:33 EDT 2003
In the near past (March 11-13) there were a couple of threads about the
possibility to use multiple interfaces on a sensor, to collect alerts and
logs from multiple sources.
One possible use could be a sensor interface before the firewall and one
placed elsewhere, behind it.
Normally the outside interface should be configured in stealth mode, in
order to avoid (as much as possible) its detection from malicious sources.
The dual interface is supported (though not recommended, I understand, by
some people who replied to the original message) by inserting the option:
on the command line.
This configuration works also if you have a stealth mode interface, i.e. ,
you do not get error messages when you run the process but it seems that
the logs and the alert are not from the two interfaces but only from the
interface having the IP address.
I tried this with version 1.9.1, so I cannot confirm whether version 2.0.x
has a different behavior.
I wish to read some comments from those who also experimented such
configuration, that in my humble opinion could work fine (no significant
packet loss) with some good quality ethernet cards and a fast (current) PC.
More information about the Snort-users