[Snort-users] Multiple sensors/interfaces, same daemon

Sergio Caltagirone scaltagi at ...12056...
Thu Jul 1 11:13:35 EDT 2004


Hey all, how do i configure a single snort daemon to act as a sensor on
two interfaces?  

When I try '-i any' i pick up alot of traffic from 127.0.0.1 - which I'm
guessing is the loopback; however, I get none from eth1 and just fine
from eth0.  

Also, with 2 interfaces, how should the $HOME_NET and $EXTERNAL_NET be
set?

Thanks,
Sergio





More information about the Snort-users mailing list