Re: [Snort-users] running snort on multiple interfaces (OpenBSD)

["CS Lee" <geek00l@gmail.com>]

Soner,

If you are in bridge mode, sniffing on one of the interface should be enough as any of the interface should see all the traffics. So that doesn't matter.

And it is fine that bridge has no IP and snort will still work.

We need to know more about your setup, it's a bit unclear, I'm wondering why you should configure IP for the network interfaces.

On 4/9/07, Soner Tari <list@kulustur.org> wrote:

Hi,

I need to run snort on multiple interfaces. Currently, I'm running
multiple snort instances to achieve this, but this stretches the shared
memory.

I've read FAQ 3.6, where it reads I should use a bridge interface on
*BSD systems. I've tried that advice by creating bridge0, adding
physical interfaces to it, upping it (per the brconfig(8) examples), and
finally starting snort with "-i bridge0" argument. Snort starts (though,
complaining that bridge0 is not assigned any IPs), but I cannot see any
alerts.

Otherwise, I use nmap to trigger alerts, and I can generate alerts very
easily by providing snort with, say, "-i vr0".

In order to clarify what I did, I need to assign IPs to all of the
physical interfaces, thus I cannot follow the examples in brconfig(8)
verbatim.

Do I need to do anything else, or am I missing something? How do I
achieve "any" interface on OpenBSD?

I would appreciate any help,
Thanks,




-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Best Regards,

CS Lee<geekooL[at]gmail.com>
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users