Snort mailing list archives
problem with 2 interfaces......pls help!!
From: "Tinu Patel" <tinu.patel () insignis com>
Date: Tue, 27 Nov 2001 12:24:59 -0600
Hi folks.... I am pretty new to snort...so this may be a dumb question but here goes... I have a snort box that has 2 sensors running on 2 different nic's. One of the nic's is capturing data outside the firewall and is working perfectly fine. The other nic is capturing data inside the firewall from a monitor port on an HP switch (where we forwarded all switch traffic to). The internal sensor is only picking up UDP data... and a TON of it. It doubled the database size and then some in one night just from garbage sensor reports. Why is it not picking any TCP traffic? Am I doing something wrong here? My snort.conf has: log tcp any any -> 10.10.0.0/20 any any Thanks Tinu
Current thread:
- problem with 2 interfaces......pls help!! Tinu Patel (Nov 27)
