Skip to content

Monitoring multiple interfaces after successful tutorial install

Featured Replies

Hello.  I am new to Snort and was able to bring up a functioning IDS using your really easy to follow guide.  This is an amazing learning experience.  Using some of the other posts, I was able to go in and change credentials so it is a bit more secure.  After the successful install, a requirement was added to have the box monitor multiple taps on 2 interfaces.  Being new, I have scrambled around and found that it is possible by running multiple Barnyard2 & Snort instances.  I have read Snort can run multiple instances inside itself on the one box. As long as you have separate Snort.conf files for each interface with a matching Barnyard2 instance logging will be fine.

My issue is that I am struggling to figure out how to make this happen within the context of your guide.  Any help that anyone could give me would be greatly appreciated.  

 I have also seen bridging NICS can sort of lead to a similar result, but I wasn't sure if that was a viable option.

  • 6 years later...

You will need to bridge the two NIC's and in Windows 10 do it as below:

Bridging Your Internet Connections on Windows 10

Step 1: Go to your Control Panel from the Start menu.

Step 2: Navigate to Network Connections.

Step 3: Click on the first NIC that you want to bridge.

Step 4: Hold down the CTRL key while clicking on the second NIC that you want to bridge.

Step 5: Right-click on one of the selected NICs and click "Bridge Connections."

I have not tested the above on anything other than Windows 10.

Create an account or sign in to comment

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

Account

Navigation

Search

Search

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.