[Snort-users] running snort on multiple interfaces (OpenBSD)

CS Lee geek00l at ...11827...
Fri Apr 13 23:47:28 EDT 2007


If you are in bridge mode, sniffing on one of the interface should be enough
as any of the interface should see all the traffics. So that doesn't matter.

And it is fine that bridge has no IP and snort will still work.

We need to know more about your setup, it's a bit unclear, I'm wondering why
you should configure IP for the network interfaces.

On 4/9/07, Soner Tari <list at ...14096...> wrote:
> Hi,
> I need to run snort on multiple interfaces. Currently, I'm running
> multiple snort instances to achieve this, but this stretches the shared
> memory.
> I've read FAQ 3.6, where it reads I should use a bridge interface on
> *BSD systems. I've tried that advice by creating bridge0, adding
> physical interfaces to it, upping it (per the brconfig(8) examples), and
> finally starting snort with "-i bridge0" argument. Snort starts (though,
> complaining that bridge0 is not assigned any IPs), but I cannot see any
> alerts.
> Otherwise, I use nmap to trigger alerts, and I can generate alerts very
> easily by providing snort with, say, "-i vr0".
> In order to clarify what I did, I need to assign IPs to all of the
> physical interfaces, thus I cannot follow the examples in brconfig(8)
> verbatim.
> Do I need to do anything else, or am I missing something? How do I
> achieve "any" interface on OpenBSD?
> I would appreciate any help,
> Thanks,
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share
> your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

Best Regards,

CS Lee<geekooL[at]gmail.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070414/7d6f8592/attachment.html>

More information about the Snort-users mailing list