Home page logo
/

snort logo Snort mailing list archives

Re: Different bpf filter for every multiple config used in snort
From: Russ Combs <rcombs () sourcefire com>
Date: Tue, 21 May 2013 08:17:36 -0400

Probably not in that form.  I'm guessing you actually want to select a
policy by BPF, not the other way around.  What are you trying to do
beyond the network or  VLAN bindings available now?

On Tue, May 21, 2013 at 1:47 AM, C. L. Martinez <carlopmart () gmail com> wrote:
On Sun, May 19, 2013 at 7:01 PM, Russ Combs <rcombs () sourcefire com> wrote:
On Sun, May 19, 2013 at 2:04 PM, C. L. Martinez <carlopmart () gmail com> wrote:
On Fri, May 17, 2013 at 7:12 PM, Eoin Miller
<eoin.miller () trojanedbinaries com> wrote:
On 5/17/2013 15:09, C. L. Martinez wrote:
Hi all,

 Is it possible to use one bpf filter config file for every multiple
config in snort 2.9.4.6?

Thanks.


I always created a skeleton conf file and the custom conf file that I
would call when starting the process.


snort -c /etc/snort/customized_snort.conf


And then inside of customized_snort.conf you can have:

include /etc/snort/skelton_snort.conf



That way you just put in the variables that change for your instances
you are running in the small conf and don't have to edit the N-number of
conf's every time to setup something different.

-- Eoin



Thanks Eoin, but this doesn't solves how can I assign a bpf filter for
every multiple snort config file ...

That actually can't be done.  The BPF is handled by the DAQ, and there
is only one per Snort.  So the BPF file can be configured just once
either on the command line or in the default conf.  If you run
multiple Snort instances, then you can give each instance a different
BPF.


Thanks Russ ... But, could be a good feature to be included in next
snort relesases??

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault