RE: Two Ethernet Interfaces?

["Mike Koponick" <mike () redhawk info>]

Peter,

Thanks for your quick response. I think I will "wait and see" if the network
interface gets bogged down before installing a second interface.

Thanks again.

Mike

-----Original Message-----
From: Peter Param [mailto:pparam () stvincents com au]
Sent: Monday, November 04, 2002 2:49 PM
To: snort-users () lists sourceforge net; mike () redhawk info
Subject: Re: [Snort-users] Two Ethernet Interfaces?


Not really,  you should be able to run off a single nic quite nicely -
if the combined traffic on switched port is not more than what your lan
card can take.  You should also be able to snort off several nics if you
have several segments.

cheers

-Peter

> > > "Mike Koponick" <mike () redhawk info> 11/05/02 09:28 AM >>>
I was wondering if it was absolutely necessary to have TWO ethernet
interfaces for the Snort sensor? Is this done for security or
performance
issues? I would think that if you had one interface it would work fine
if
there wasn't a lot of traffic. However, I would like to run in promisc
mode,
as I could "catch" more traffic that way, so I would assume if you
wanted to
run in promisc mode you would have to have two ethernet interfaces,
true?

Thanks in advance for you help.

Mike



-------------------------------------------------------
This SF.net email is sponsored by: ApacheCon, November 18-21 in
Las Vegas (supported by COMDEX), the only Apache event to be
fully supported by the ASF. http://www.apachecon.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been
virus scanned and although no viruses were detected by the system,
St Vincent's Hospital accepts no liability for any consequential
damage resulting from email containing any computer viruses.

**********************************************************************



-------------------------------------------------------
This SF.net email is sponsored by: ApacheCon, November 18-21 in
Las Vegas (supported by COMDEX), the only Apache event to be
fully supported by the ASF. http://www.apachecon.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users