|
|
|
|
Snort Forums Archive
Archive Home » Support » can SNORT support two NICs?
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
can SNORT support two NICs?
Posted by Colm on March 26, 2005 05:36:39
I config SNORT to Packet-Logger mode,but still capture eth0's packet,can't capture eth2's packet.
Can someone tell me ,how to do?? |
|
Posted by techie411 on March 26, 2005 17:29:41
Yes, I have done so by editing:
/etc/sysconfig/snort
When you see the "INTERFACE" option, add your interfaces. Mine looks like the following:
INTERFACE="eth2 eth3"
I have snort listening on eth2 and eth3.
Hope this helps you out.
-Chris |
|
Posted by jvhaysx on March 28, 2005 04:49:11
I have a slightly different solution. I have a management interface with an IP address and a second quad NIC (no IP addresses). I start 4 instances of snort and point each one to a seperate conf file:
/usr/local/bin/snort -D -i eth1 -c /usr/local/snort/etc/snort-eth1.conf
/usr/local/bin/snort -D -i eth2 -c /usr/local/snort/etc/snort-eth2.conf
/usr/local/bin/snort -D -i eth3 -c /usr/local/snort/etc/snort-eth3.conf
/usr/local/bin/snort -D -i eth4 -c /usr/local/snort/etc/snort-eth4.conf
|
|
|
|
|
|
