[Oisf-users] Sniffing traffic in two interfaces using one suricata instance

carlopmart carlopmart at gmail.com
Sat Jun 2 16:55:55 UTC 2012


Hi all,

  Is it possible to monitor traffic in two interfaces at the same time 
using only one suricata instance?? I don't want to configure Suricata as 
an IPS, only as an IDS.

  My host is a FreeBSD 9.0 i386 conected to several interfaces, but I 
only need to sniff traffic in two of them: in bridge0 and em9 ... One 
interface is a bridge (bridge0) that acts as a virtual tap. The other 
interface (em9) collects traffic from another FreeBSD 9.0 hosts that 
acts a virtual tap, too ..

  Is it possible?? Or do I need to configure two Suricata instances??

  Thanks.

-- 
CL Martinez
carlopmart {at} gmail {d0t} com




More information about the Oisf-users mailing list