[Snort-users] Snort on multiple interfaces
elof at ...6680...
Wed Nov 19 09:59:06 EST 2003
On Wed, 19 Nov 2003, STEPHEN W. COREY - 5535 wrote:
> If I configure Snort on multiple interfaces (either by the libpcap
> method, or the -i method), will snort report the data as coming from 2
> different sensors? This is the effect I'm hoping to achieve, anyways.
I run three snort processes on the same nic and two snorts on another nic.
All of the log to MySQL, and each process is displayed as a unique sensor.
snort blahblah -i eth0 blahblah net 10.0.0.0/8
snort blahblah -i eth0 blahblah net 172.22.0.0/16
snort blahblah -i eth0 blahblah net 192.168.0.0/16
snort blahblah -i eth1 blahblah net 172.16.0.0/16
snort blahblah -i eth1 blahblah net 172.20.0.0/16
More information about the Snort-users