Re: Snort with two sniffing interfaces

[Edward Bjarte Fjellskål <edward.fjellskal () redpill-linpro com>]

Crook, Parker wrote:
> Either run two instances:
>
> /snort/snort -D -N -i eth0 -c /snort/conf/snort.conf
>
> /snort/snort -D -N -i eth1 -c /snort/conf/snort.conf
>
>  
>
>  or bond the interfaces:
>
> /snort/snort -D -N -i bond0 -c /snort/conf/snort.conf
>
>  
>
> Personally I run two instances because I have two logically different
> environments I am sniffing and want/need to run two different configs;
> if I didn’t have this need I would probably go the bonded route.

Hi,

I Just wanted to add the little talked about feature of snort, where
you can define virtual networks, example:

config binding: /etc/snort/vips/snort-0.conf net 192.168.0.0/24
config binding: /etc/snort/vips/snort-1.conf net 192.168.1.0/24
config binding: /etc/snort/vips/snort-2.conf net 192.168.2.0/24

So, you have a default /etc/snort/snort.conf and configure that as
a fall-back configuration (Catch all traffic not handled by your
virtual configs) and then add the statements above. You can then
configure snort-0.conf, snort-1.conf, snort-2.conf to handle their
respective traffic (Variables, rules, preprocessors etc).

In this case, if you have:
192.168.0.0/24 on eth1
192.168.1.0/24 on eth2
192.168.2.0/24 on eth3

you would need to bond them together and have snort listen on the bonded
interface.

My gut feelings are that there are some performance and memory benefits
firing up one instance of snort configured with virtual-networks, then
firing up X instances of snort, but I have not done any tests.
*I would like to hear thoughts from other playing with this feature*

Best regards,
Edward Fjellskål


>  
>
> -Parker
>
>  
>
> ------------------------------------------------------------------------
>
> *From:* Andy Berryman [mailto:aberryman () Cymtec com]
> *Sent:* Tuesday, May 18, 2010 1:11 PM
> *To:* snort-users () lists sourceforge net
> *Subject:* Re: [Snort-users] Snort with two sniffing interfaces
>
>  
>
> So, if you want to use snort to sniff on two interfaces, how do you use
> the same config file? Is that possible?  Or should I just bond them and
> make snort listen on the bonded interface?
>
>  
>
> When I try it like this, I get errors b/c of the .so rules.
>
>  
>
> /snort/snort -D -N -i eth0 -i eth1 -c /snort/conf/snort.conf
>
>  
>
> May 18 17:05:54 (none) snort[14547]: FATAL ERROR:
> /snort/conf/snort.rules(46) : pcre compile of
> "(<object\s*[^>]*\s*id\s*=\s*(?P<m13>\x22|\x27|)(?P<id1>.+?)(?P=m13)(\s|>)[^>]*\s*classid\s*=\s*(?P<q27>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*77829F14-D911-40FF-A2F0-D11DB8D6D0BC\s*}?\s*(?P=q27)(\s|>).*(?P=id1)\s*\.\s*(SetFormatLikeSample|CreateFile)|<object\s*[^>]*\s*classid\s*=\s*(?P<q28>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*77829F14-D911-40FF-A2F0-D11DB8D6D0BC\s*}?\s*(?P=q28)(\s|>)[^>]*\s*id\s*=\s*(?P<m14>\x22|\x27|)(?P<id2>.+?)(?P=m14)(\s|>).*(?P=id2)\.(SetFormatLikeSample|CreateFile))\s*\("
> failed at offset 30 : unrecognized character after (?
>
>  
>
> Thanks,
>
> Andy Berryman
>
>  
>
> ------------------------------------------------------------------------
>
> This message from Cymtec Systems, Inc. contains confidential information
> and is solely for the use of the recipient(s) named above. If you are
> not the intended recipient or an agent responsible for delivering it to
> the intended recipient, you are hereby notified that you have received
> this message in error and that any review, disclosure, copying,
> distribution or use of the contents of this message is strictly
> prohibited. If you have received this message in error, please destroy
> it immediately and notify Cymtec Systems, Inc. by telephone at
> +1.314.993.8700 or by return e-mail.
>
> ------------------------------------------------------------------------
>
>  
>
>
> ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------------
>
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users