Cpu, Snort won't run on multiple interfaces out of the box, see the Snort faq: http://www.snort.org/docs/faq.html#3.4
So you need to apply a patch to libpcap to make this possible. Eric > >Does snort/uclibc-bering not support multiple interfaces? It seems that >it will only listen on a single interface per instance. I have modified >the init script arguments to look like this: > >before: >"-m 027 -D -c /etc/snort/snort.conf -l /var/log/snort -d -i $INTERFACE" >after: >"-m 027 -D -c /etc/snort/snort.conf -l /var/log/snort -d" > >My understanding is that this should support the "var HOME_NET any" / >"var EXTERNAL_NET any" options. Even with these settings, it defaults >to eth0. > > > >__________________________________________________ >Do You Yahoo!? >Tired of spam? Yahoo! Mail has the best spam protection around >http://mail.yahoo.com > > >------------------------------------------------------- >This SF.Net email is sponsored by Oracle Space Sweepstakes >Want to be the first software developer in space? >Enter now for the Oracle Space Sweepstakes! > > [Message truncated. Tap Edit->Mark for Download to get remaining portion.] ------------------------------------------------------- This SF.Net email is sponsored by Oracle Space Sweepstakes Want to be the first software developer in space? Enter now for the Oracle Space Sweepstakes! http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click ------------------------------------------------------------------------ leaf-user mailing list: leaf-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
