Re: Snort with two sniffing interfaces

["Crook, Parker" <Parker_Crook () reyrey com>]

Either run two instances:

/snort/snort -D -N -i eth0 -c /snort/conf/snort.conf

/snort/snort -D -N -i eth1 -c /snort/conf/snort.conf



 or bond the interfaces:

/snort/snort -D -N -i bond0 -c /snort/conf/snort.conf



Personally I run two instances because I have two logically different environments I am sniffing and want/need to run 
two different configs; if I didn't have this need I would probably go the bonded route.



-Parker



  _____

From: Andy Berryman [mailto:aberryman () Cymtec com]
Sent: Tuesday, May 18, 2010 1:11 PM
To: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Snort with two sniffing interfaces



So, if you want to use snort to sniff on two interfaces, how do you use the same config file? Is that possible?  Or 
should I just bond them and make snort listen on the bonded interface?



When I try it like this, I get errors b/c of the .so rules.



/snort/snort -D -N -i eth0 -i eth1 -c /snort/conf/snort.conf



May 18 17:05:54 (none) snort[14547]: FATAL ERROR: /snort/conf/snort.rules(46) : pcre compile of 
"(<object\s*[^>]*\s*id\s*=\s*(?P<m13>\x22|\x27|)(?P<id1>.+?)(?P=m13)(\s|>)[^>]*\s*classid\s*=\s*(?P<q27>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*77829F14-D911-40FF-A2F0-D11DB8D6D0BC\s*}?\s*(?P=q27)(\s|>).*(?P=id1)\s*\.\s*(SetFormatLikeSample|CreateFile)|<object\s*[^>]*\s*classid\s*=\s*(?P<q28>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*77829F14-D911-40FF-A2F0-D11DB8D6D0BC\s*}?\s*(?P=q28)(\s|>)[^>]*\s*id\s*=\s*(?P<m14>\x22|\x27|)(?P<id2>.+?)(?P=m14)(\s|>).*(?P=id2)\.(SetFormatLikeSample|CreateFile))\s*\("
 failed at offset 30 : unrecognized character after (?



Thanks,

Andy Berryman



  _____

This message from Cymtec Systems, Inc. contains confidential information and is solely for the use of the recipient(s) 
named above. If you are not the intended recipient or an agent responsible for delivering it to the intended recipient, 
you are hereby notified that you have received this message in error and that any review, disclosure, copying, 
distribution or use of the contents of this message is strictly prohibited. If you have received this message in error, 
please destroy it immediately and notify Cymtec Systems, Inc. by telephone at +1.314.993.8700 or by return e-mail.

  _____



------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users