[Snort-users] snort with two interface

Jaime Nebrera jnebrera at ...11827...
Wed Dec 5 11:16:55 EST 2012


   Hi Leonardo,

   This is not fully right. With proper patching Snort can read from 
multiple interfaces within the same instance. This is BTW, what we have 
done in redBorder project

On 05/12/12 17:11, Leonardo Pezente wrote:
> yeah yuo were right, i just can run one interface per instance of 
> snort i run.
> thanks James
> 2012/12/5 Lay, James <james.lay at ...15009... 
> <mailto:james.lay at ...15009...>>
>
>     *From:*Leonardo Pezente [mailto:lmpezente at ...11827...
>     <mailto:lmpezente at ...11827...>]
>     *Sent:* Wednesday, December 05, 2012 8:52 AM
>     *To:* snort-users at lists.sourceforge.net
>     <mailto:snort-users at lists.sourceforge.net>
>     *Subject:* [Snort-users] snort with two interface
>
>     i have the snort in the border of a network, and how this topic
>     shows, it has two interface. i have put the HOME_NET equal to the
>     ip of the both interfaces.
>
>     the think is: in one of them i can detect attacks, but in the
>     other i cant.
>
>     when i start to test, i was using just one (the iterface that is
>     detecting).
>
>     but i need particular that the other detect too. so, what could be
>     wrong?
>
>     my snort.conf is working fine, and i he is starting on boot
>     sniffing both interface.
>
>     This might be a problem with pcap?
>
>     I believe Snort can only listen on one interface at a time, so you
>     may want to run two separate instances of snort.
>
>     James
>
>
>
> ------------------------------------------------------------------------------
> LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
> Remotely access PCs and mobile devices and provide instant support
> Improve your efficiency, and focus on delivering more value-add services
> Discover what IT Professionals Know. Rescue delivers
> http://p.sf.net/sfu/logmein_12329d2d
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20121205/d058221e/attachment.html>


More information about the Snort-users mailing list