[Snort-users] Bonding or bridging two subnets

Robert Welz welz at ...13668...
Wed Dec 28 04:48:04 EST 2005

Now everythig becomes confusing. First my original posting had an immediate reply (not 
to the list but to me privately) in french which I didn't understand. I thoght the 
message was rejected due to some unicode / iso charset mismatch. It looked really 
wiered, especially if you don't speak a single word french. especially not 

Then barryab63 answered me (thx barryab63!), but to my private postbox and to the list 
but I replied to him and not to the list.

To get things back on track I post my second question here again.

barryab63-ia at ...131... wrote:
 > I don't think you'll want to bond or bridge the two interfaces in the case you 
describe.  I think you'll want to run multiple instances of snort, one for each of the 
two interfaces you want to monitor.  If you installed via RPM on SUSE I think you can 
do this by changing the settings in the /etc/sysconfig/snort file.  You just tell it 
which interfaces you want snort to monitor and it pretty much takes care of everything 
for you.
 > Barry

Runnig two processes of snort on the same machine has more computing costs than 
running one process? I have 3 Gigabit (although 32Bit cards) which I want to observe. 
Will my 2.6 GHZ Celeron be enough? I plan logging to a different machine though.

SquirrelMail looks wired with unicode

Betreff:  	Notification d'=?unicode-1-1-utf-7?Q?+AOk-tat de remise
Von:  	postmaster at ...12594...
Datum:  	Mi, 28.12.2005, 13:01
An:  	welz at ...13668...
Priorität:  	Normal
Optionen:  	Alle Kopfzeilen anzeigen |  Druckversion zeigen

Cette notification d'+AOk-tat de remise est g+AOk-n+AOk-r+AOk-e

+AMk-chec de la remise aux destinataires suivants.

Thunderbird yeah!

Cette notification d'état de remise est générée automatiquement.

Échec de la remise aux destinataires suivants.

        anjah at ...12594...

Reporting-MTA: dns;imedia-hvj182q6.imedia.net
Received-From-MTA: dns;imedia.fr
Arrival-Date: Wed, 28 Dec 2005 13:01:35 +0100

Final-Recipient: rfc822;anjah at ...12594...
Action: failed
Status: 5.1.1

[Snort-users] Bonding or bridging two subnets
"R. Welz" <welz at ...13668...>
Wed, 28 Dec 2005 12:58:02 +0100 (CET)
<snort-users at lists.sourceforge.net>
from mail pickup service by imedia-hvj182q6.imedia.net with Microsoft SMTPSVC; Wed, 28 
Dec 2005 13:01:35 +0100
welz at ...13668...
from mx13.bcrtfl01.us.mxservers.net ( by mail01k.rapidsite.net (RS ver 
1.0.95vs) with SMTP id 0-0706701145 for <anjah at ...12594...>; Wed, 28 Dec 2005 06:59:17 
-0500 (EST)

More information about the Snort-users mailing list