Re: [Snort-users] Promiscuous mode on only one interface

This will most likely be the first of many responses that read somewhat like the following:

http://www.snort.org/docs/faq.html#3.4

--faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq-- Q: How can I run snort on multiple interfaces simultaneously.

1. If you aren't running snort on linux 2.1.x/2.2.x kernel (with LPF available) the only way is to run multiple instances of snort, one instance per interface (with the -i option specifying the interface). However for linux 2.1.x/2.2.x and higher you can use libpcap library with S. Krahmer's patch which allows you to specify 'any' as interface name. In this case snort will be able to process traffic coming to all interfaces. --faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq--

On Sat, 2003-03-29 at 14:36, Brei, Matt wrote:
> Greetings,

-- 
Patrick S. Harper | CISSP MCSE
patrick@internetsecurityguru.com
www.internetsecurityguru.com

"If we aren't supposed to eat 
animals, why are they made
of meat?"




-------------------------------------------------------
This SF.net email is sponsored by:
The Definitive IT and Networking Event. Be There!
NetWorld+Interop Las Vegas 2003 -- Register today!
http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users