Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]

Re: [Snort-users] Multiple instances of snort on one box?

Subject: Re: [Snort-users] Multiple instances of snort on one box?
Date: Fri, 22 Oct 2004 10:59:13 +0200
Hi,

Matt Kettler wrote:

At 03:39 PM 10/21/2004, Drew Stockman wrote:

...

Depends a bit on your OS.. Most linuxes will support -i "any" which will allow a single snort process to sniff all three.. However, your results will be mixed together.

What I mislike on "any" is that it also will be capturing on loopback.
So remember to disable the appropriate rules. Unfortunately there is
some real traffic on the Internet claiming to be from 127.0.0.1. Since the lo intarface has no MAC there is no to me known possibility to blend
this traffic out.


Additionally the promisc mode will not work with "-i any".

So beware.

Regards,
Edin


-- Edin Dizdarevic


------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users

<Prev in Thread] Current Thread [Next in Thread>