[Snort-Users] differentiate between eth0 and eth1

eamonn doyle edoyle at ...11544...
Thu Apr 1 12:27:02 EST 2004


Hello snort users!

I am new to snort and have what I am sure is a very simple question at least 
for you folks.  I have a single snort box with 2 ethernet cards, and 2 snort 
processes running.  I start the process from within the directory where 
snort.conf resides:

/usr/local/bin/snort -i eth0 -D
/usr/local/bin/snort -i eth1 -D

I am logging very simply to the /var/log/messages file, and would like to know 
if there is a way to differentiate between each interface that is snorting.  


More information about the Snort-users mailing list