[Snort-users] Snort on multiple interfaces

Martin Olsson elof at ...6680...
Wed Nov 19 09:59:06 EST 2003


On Wed, 19 Nov 2003, STEPHEN W. COREY - 5535 wrote:
> If I configure Snort on multiple interfaces (either by the libpcap
> method, or the -i method), will snort report the data as coming from 2
> different sensors? This is the effect I'm hoping to achieve, anyways.

I run three snort processes on the same nic and two snorts on another nic.
All of the log to MySQL, and each process is displayed as a unique sensor.

snort blahblah -i eth0 blahblah net 10.0.0.0/8
snort blahblah -i eth0 blahblah net 172.22.0.0/16
snort blahblah -i eth0 blahblah net 192.168.0.0/16
snort blahblah -i eth1 blahblah net 172.16.0.0/16
snort blahblah -i eth1 blahblah net 172.20.0.0/16






More information about the Snort-users mailing list