Multiple network segment monitor with Snort

From: Sergio Pozo Hidalgo (blitter_es_at_yahoo.es)
Date: 09/24/03

  • Next message: Thompson, Jimi: "RE: "False positive" database idea"
    Date: Wed, 24 Sep 2003 20:59:28 +0200
    To: focus-ids@securityfocus.com
    
    

    Hi,
    I'm planning to deploy a lab network where there will coexist some
    manageable layer 2 switches with VLANs and trunk ports to bind a Snort
    sensor to.
    The problem is that we're short on budget and I wan't to deploy various
    Snort sensors at different network zones.

    Can I use the same physical machine (with as many ethernet cards as
    sensors I want to deploy) and use various and independent snort
    processes? I neither know if only one Snort process can control
    different network cards at the same time. And yes, I know that I can hog
    the sensor, but the networks are going to have little traffic (at least
    right now!).

    Thank you very much in advance.

    Regards,
    Sergio Pozo

    ---------------------------------------------------------------------------
    Captus Networks IPS 4000
    Intrusion Prevention and Traffic Shaping Technology to:
     - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
     - Automatically Control P2P, IM and Spam Traffic
     - Precisely Define and Implement Network Security & Performance Policies
    FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo
    http://www.securityfocus.com/sponsor/CaptusNetworks_focus-ids_000101
    ---------------------------------------------------------------------------


  • Next message: Thompson, Jimi: "RE: "False positive" database idea"