Snort mailing list archives
RE: Running 2 instances of snort
From: "Michael Steele" <michaels () silicondefense com>
Date: Fri, 14 Jun 2002 18:44:02 -0700
Archer, You could do this by running the second instance from a script, but why do you want to run 2 instances of Snort? You have 2 cards, why don't you run Snort in promiscuous mode on one interface and use the other interface for management console. That's what I do. If you really want to do this, here is a link to some documentation on our site that tells how to do this. Let me say that this documentation is outdated, but should give you an idea of how to do what you want to do. http://www.silicondefense.com/techsupport/winsnortisa.htm Michael Steele | System Engineer / System Administrator mailto:michaels () silicondefense com http://www.silicondefense.com -----Original Message----- From: Archer [mailto:archer () ironcomet com] Sent: June 14, 2002 9:30 AM To: michaels () silicondefense com Subject: Running 2 instances of snort -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 First let me say that your tutorials are spot on. I was really impressed with the detail of the guides. I do have one question for you, if you have a moment. I decided I was going to run 2 copies of Snort on the same box. I have 2 NICs in it. I got the first one up and running without a hitch. For the second, I changes c:\snort to c:\snort2 and followed the guide from there. Everything went fine except have 2 services of snort installed. Is there a way 2 have two separate snort services running at the same time? Everything else seems to work fine. Both snorts will capture data and send to MySQL. I tried to clone the other copy of snort in the registry, but this did not seem to work. Any input on this would be appreciated. Thank you. Archer - --------------------------------------------------------------------- The information in this email is confidential and is intended solely for the addressee(s). If you are not the intended recipient, be advised that you have received this email in error and that any use,dissemination,forwarding, printing, or copying of this email is strictly prohibited. If you have received this email in error please contact the sender. - --------------------------------------------------------------------- To receive my PGP key, send a blank email to the following address- archer-pgp () ironcomet com - -----BEGIN PGP SIGNATURE----- Version: 6.5.8ckt http://www.ipgpp.com/ iQIVAwUBPQoaFBhauNe7Y4xFAQpr2g//VUl1BqPzxRrDivseF3SNtmMjVwibDq4Z fxx6vW2tqW7KdbQAFe92b7Vz+MVMa9FQkAin8uoc6SWdmyxpZ41pgtz73Yju46GX Tm8pPmdhgwu/XO6aibd/rVtGfIrcKETr6lGUesUYj1gosTJtpS9BydqUeHQWtWVI Z6ZBdA/yfrJ3VamzpfYr7nKNDaZiR7AFmzn0ufzRr+475fPzDAvuGtFlaTjn1+1F Dn4LEEgycH13cKTGD1TIwCamfqjogu8QlSWrJ6fj+ac8sroBfrBPPtlNcRi8wpnZ hHqUCoEzs2JONKW2czjyBfmYZCHQkp6KroygYvPFyc6XCyPeeemxywZq7dytFs11 XPZhnIXn94xbUfFlgjWJLTlGw+Ma9Abs32Orbl9ymkv0W2pIhChs1tptLNx3BS3H IBumon6fKUv8oFz6AnUxqxpCz0jbwPeRva0/lwwGP6dYloagPbaOqPweHDyWIRa/ Qsna2G7NwuYLkzsB45kHMXm9Rx/hiY3dimEyIdt/Pad9/03bjaiFyyINERicVWVm /DOWED5qqiE+wtMTwUoF59IJUBRXg0zVsYMmGtF/1N9EEDi3USJyJHDKfFYxKRR4 fgh4x2p+xqLXQANwlQIG4Ch4P0E0jTSoasYas8z+fvbnkzWxfhcEg9m95Mg36au+ PXgBVnT09f0= =QE5K -----END PGP SIGNATURE----- _______________________________________________________________ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas - http://devcon.sprintpcs.com/adp/index.cfm?source=osdntextlink _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: Running 2 instances of snort Michael Steele (Jun 14)
- <Possible follow-ups>
- RE: Running 2 instances of snort Michael Steele (Jun 15)