Snort mailing list archives
Re: Taps
From: Bennett Todd <bet () rahul net>
Date: Mon, 16 Jun 2003 09:59:41 -0400
2003-06-16T08:30:47 Poppi, Sandro:
I've been using linux' "channel bonding" feature with [ to aggregate traffic from multiple NICs into a single snort ] Worked without probs (as far as I remember ;)
No problems, but a couple of warnings. (1) Unless you're using a very recent (not yet integrated into any standard kernel dist as far as I know) bonding driver, you _must_ ifconfig the bond0 interface promisc before you ifenslave --- until very recently, the bonding driver doesn't propogate promisc mode down to the enslaved interfaces except at ifenslave time; snort's setting the interface promisc won't take. (2) When you ifenslave unnumbered interfaces, ifenslave howls, all sorts of warnings about its inability to propogate addresses back and forth. These can be safely ignored, it works fine. The above caveats notwithstanding, this setup works great, I don't know a better way to aggregate traffic from multiple NICs into one snort --- on Linux. This is very very low overhead, and simple. Other platforms will of course need other solutions. I don't know what's the recommended approach with OpenBSD. -Bennett
Attachment:
_bin
Description:
Current thread:
- AW: Taps Poppi, Sandro (Jun 16)
- Re: Taps Bennett Todd (Jun 16)