> Is it possible to have snort ( 1.8.1-RELEASE ) running in
> promiscuous mode in more than one interface ??? Ommiting the -i
> interface seems to make snort getting the first available
> interface and
> using it in promiscuous mode.
>
I created a snort initscript where you can handle this behaviour resulting in
one snort process running for each given interface. Take a look on my Snort
Statistics HOWTO at http://www.lug-burghausen.org/projects/index.htm#snort-stat.
If you want to use snort with all interfaces of your snort box try using -i any,
this requires an actual version of libpcap.

HTH,
Sandro

_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]