[Snort-users] Snort Install for monitoring 5 interfaces?

sEc nErD umkcguy1978 at ...131...
Tue Feb 8 07:23:11 EST 2005

Hi LEon,Thanks for your reply.Ok right now i have set it up in a test lab enviornment and its listening on one interface.I am still not clear what i would have to do for listening on 5 different interfaces???
i have the acid up and running just not contacting the mysql database but tht i will struggle and work around,but i do need to understand the part for 5 interfaces...could you please detail on thzt

Leon Ward <leon at ...9950...> wrote:
Sorry if this is a bit quick, but in a rush.

snort needs to connect to a single interface on start-up, this leaves
you with two options.
A) Have multiple snort instances running bound to each interface.
- This will allow you to customise the configuration for each, I assume
you will want to protect different things on the DMZ compared to the
B) Team the interfaces together so you can attach snort to interface

Take a look at the following link, it may answer a few questions (I'm a
debian man myself)

Hope the above helps.


On Sun 2005-02-06 at 06:04 -0800, sEc nErD wrote:
> hi all,
> We ahve to install snort on a box running fedora.
> And this snort is supposed to listen on 5 interfaces 
> inside pix,outside pix and 3 dmz's.
> could anyone give some precautions and pointers for
> the install to be taken since its going to listen on 5
> interfaces .Right now am building the box from scratch
> by putting in network cards and installing fedora on
> it ,any precuation on that stage??
> thanks all in advance
> __________________________________ 
> Do you Yahoo!? 
> Yahoo! Mail - You care about security. So do we. 
> http://promotions.yahoo.com/new_mail
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

Do you Yahoo!?
 Yahoo! Search presents - Jib Jab's 'Second Term'
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050208/b45289d1/attachment.html>

More information about the Snort-users mailing list