Sign in to follow this  
Followers 0
Fongin1

Monitoring multiple interfaces after successful tutorial install

2 posts in this topic

Hello.  I am new to Snort and was able to bring up a functioning IDS using your really easy to follow guide.  This is an amazing learning experience.  Using some of the other posts, I was able to go in and change credentials so it is a bit more secure.  After the successful install, a requirement was added to have the box monitor multiple taps on 2 interfaces.  Being new, I have scrambled around and found that it is possible by running multiple Barnyard2 & Snort instances.  I have read Snort can run multiple instances inside itself on the one box. As long as you have separate Snort.conf files for each interface with a matching Barnyard2 instance logging will be fine.

My issue is that I am struggling to figure out how to make this happen within the context of your guide.  Any help that anyone could give me would be greatly appreciated.  

 I have also seen bridging NICS can sort of lead to a similar result, but I wasn't sure if that was a viable option.

Share this post


Link to post
Share on other sites

You will need to bridge the two NIC's and in Windows 10 do it as below:

Bridging Your Internet Connections on Windows 10

Step 1: Go to your Control Panel from the Start menu.

Step 2: Navigate to Network Connections.

Step 3: Click on the first NIC that you want to bridge.

Step 4: Hold down the CTRL key while clicking on the second NIC that you want to bridge.

Step 5: Right-click on one of the selected NICs and click "Bridge Connections."

I have not tested the above on anything other than Windows 10.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0