[Snort-users] Multiple NICs in a Linux box and Snort

Michael Boman michael.boman at ...11827...
Fri Nov 19 22:51:05 EST 2004


On Mon, 8 Nov 2004 09:17:23 -0800 (PST), Bob Magnotta
<bobmagnotta at ...131...> wrote:
> 
> Can snort running on a Linux box (Suse) monitor multiple NICs or is it
> limited to one NIC? 

You can use the channel bonding driver to merge several physical NIC
to a logical NIC (mostly used when you use a tap to collect data).

You can also use the 'any' interface to collect and analyse data from
all interfaces (including the loopback interface) or run several
instances of snort (one for each interface).

Best regards
 Michael Boman




More information about the Snort-users mailing list