[Snort-users] multiple interfaces on a Snort sensor

Edin Dizdarevic edin.dizdarevic at ...7509...
Tue May 27 08:29:10 EDT 2003


francesco wrote:
> In the near past (March 11-13) there were a couple of threads about the
> [...]

> The dual interface is supported (though not recommended, I understand,
> by some people who replied to the original message) by inserting the
> option:
>     -i any
> on the command line.
> 
> This configuration works also if you have a stealth mode interface, i.e.
> , you do not get error messages when you run the process but it seems
> that the logs and the alert are not from the two interfaces but only
> from the interface having the IP address.
> 
> I tried this with version 1.9.1, so I cannot confirm whether version
> 2.0.x has a different behavior.
> 
> I wish to read some comments from those who also experimented such
> configuration, that in my humble opinion could work fine (no significant
> packet loss) with some good quality ethernet cards and a fast (current) PC.

Of course it will work. Please read the libpcap docs about this case.
Also the tcpdump-workers list is a good source.

AFAIK if you specify "any" on the command line (either snort or
tcpdump or whatever) all packets from all interfaces (including
loopback!) will be copied to the application listening.

This behaviour has nothing to do with Snort, but with kernel sockets.

Remember that in this case, the promisc mode will not work too, since
the socket is ignoring the "set promisc mode" flag.

Again: See the libpcap docs, especially those from Phill Wood...

Regards,

Edin


-- 
Edin Dizdarevic





More information about the Snort-users mailing list