[Snort-users] Binding snort to multiple interfaces

eric-dated-1083277626.193075aa63e273 at ...11523... eric-dated-1083277626.193075aa63e273 at ...11523...
Wed Apr 7 16:53:08 EDT 2004


On Wed, 2004-04-07 at 16:48:17 -0500, eamonn doyle proclaimed...

> Patrick is right, run 2 snort processes, here is what I use it will get you 
> the eth0 and eth1 you want to differentiate between the interfaces.
> 
> /usr/local/bin/snort -d -i eth0 -I -D
> /usr/local/bin/snort -d -i eth1 -I -D
> /usr/local/bin/snort -d -i eth2 -I -D
> 
> This works for me, I run it from the directory that contains the conf file and 
Thanks.

So then my question is: is any work being done on making multiple
interfaces possible? I'd think folks monitoring seperate interfaces
would enjoy this, especially if each alert was tagged with an
interface ID.




More information about the Snort-users mailing list