<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><span style="font-size: 12pt;">I apologise in advance if this is the wrong place to email questions or ask for support.</span><br><div> <br>I am currently trying to work out the best method to listen on multiple interfaces with suricata (latest 1.4.5).<br><br>My current setup is suricata, barnyard2, snort mysql, custom ui.<br><span style="font-size: 12pt;"><br></span></div><div><span style="font-size: 12pt;">The only way I can see this possible is via launching multiple instances of suricata.</span><br><br>If you listen via -i eth1 -i eth2 it creates log alerts in the same directory with the same name. Meaning there is no way for barnyard2 to tell which interface the traffic came from.<br><span style="font-size: 12pt;"><br></span></div><div><span style="font-size: 12pt;">Any suggestions please?</span><br><span style="font-size: 12pt;"><br></span></div><div><span style="font-size: 12pt;">Thanks,</span><br>Deej<br><br></div> </div></body>
</html>