<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Thanks Karl.  I'll have to see if I need to keep things separated. Take a look at this link for an el cheapo network tap.  It does require a special cable that splits the inputs to the two NICs. <a class="moz-txt-link-freetext" href="http://www.instructables.com/id/Make-a-Passive-Network-Tap/">http://www.instructables.com/id/Make-a-Passive-Network-Tap/</a> Stan Karl Schuttler wrote: <blockquote cite="mid:y2g984d708a1005031450p16ba058fhbee780dce2b6b8ec@mail.gmail.com" type="cite"> <pre wrap="">The trouble with this is that snort feeds to Barnyard, which takes snort's output and inputs it to your mysql database, which you are probably reading using BASE. You can simply run two snort commands using the -i flag to specify different interfaces; the trouble is that barnyard won't discriminate based on interface, so in BASE you'll just see all the traffic if it were from one nic. If you want to separate the alerts, you'll need a separate mysql database, snort.conf, and barnyard instance (and folder). I'm pretty sure on that; I went the cheapie route, and just used one. <a class="moz-txt-link-freetext" href="http://seclists.org/snort/2002/q2/1975">http://seclists.org/snort/2002/q2/1975</a> for more ideas. On Mon, May 3, 2010 at 4:20 PM, Stanley C. Mortel <a class="moz-txt-link-rfc2396E" href="mailto:mortel@cyber-nos.com"><mortel@cyber-nos.com></a> wrote: </pre> <blockquote type="cite"> <pre wrap="">Has anyone got enough experience configuring snort to know if it can be set to monitor traffic on two NICs at once?  What I am looking at is using a passive network tap without aggregation, thus feeding the inbound and outbound traffic to a box with two NICs installed using properly wired unidirectional sniffing cables.  Doesn't seem like you'd need two snort boxes to watch both Rx and Tx traffic going over a wire.  Anyway, I've not had much luck googling this.  So before I spent much more time on it, I thought I'd ask here. Thanks. Stan _______________________________________________ linux-user mailing list <a class="moz-txt-link-abbreviated" href="mailto:linux-user@egr.msu.edu">linux-user@egr.msu.edu</a> <a class="moz-txt-link-freetext" href="http://mailman.egr.msu.edu/mailman/listinfo/linux-user">http://mailman.egr.msu.edu/mailman/listinfo/linux-user</a> </pre> </blockquote> <pre wrap=""> </pre> </blockquote> </body> </html>