[Snort-users] multiple snort instances and snortcenter

Brian Jameson tech at ...11974...
Thu Apr 21 02:47:48 EDT 2005


John wrote:-

>Hello All,
>
>Is anyone managing multiple snort instances on one server with snortcenter?
>  I've tried to do this a couple of different ways with no success.
>  Essentially I have a system running two instances that monitor the two
legs
> of a tap (inbound/outbound) and I figured I'd just have to install
separate
> snortcenter agents running on different ports, but even though I can
connect
> to those agents directly with a browser, snortcenter can't.  I even added
>separate ip addresses to the mgmt nic (virtuals) and still they show up
red.
>I'm curious if anyone else has attempted this and got it to work.
>
>Thanks in advance!

John,
	I have two boxes with two sensors apiece that I manage from Snortcenter2.
I only use one snortcenter agent per box but possible differ from your
desired
configuration in that my sensors are on different interfaces (eth1 and 2 in
my case).
If your sensors are both linked to a single interface then it gets more
complicated as
both configurations generated by Snortcenter could have the same name which
may be why
you have gone for two versions of snortcenter agent. I think I would try
aliasing the
interface, which I think is possible.
	I did have a bit of a problem with version 2 of Snortcenteragent, I
reverted to 1
and all was well.
regards,
Brian





More information about the Snort-users mailing list