[Oisf-users] best method to monitor two NIC's on same box
orekdm at gmail.com
Fri Jun 24 22:53:18 UTC 2011
I'm new to suricata, but a longtime veteran of NSM. Due to some recent
excitement at work I got suricata working as a standalone and then as part
of the smoothsec distro. I'm happily processing away on 8 cores at
low-medium utilization. I just discovered that we have to pull another
SPAN (traffic can't be added to the first) for monitoring. What is the
best methodology to support this in suricata. I poked around, but no docs
or postings seem to discuss this issue. Can I add a second NIC to the
single instance? Do I need to have two installations side by side? Or
just a second suricata.yaml and set of startup scripts?
Forgive me if I've missed something obvious, please help!
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Oisf-users