# snort on multiple interface

## mrfree

I have 4 network interface on my home-server and I want snort sniffs only 2 of them

```
# Config file for /etc/init.d/snort

# This tell snort which interface to listen on (any for every interface)

IFACE=eth0

[...]
```

using any as IFACE value snort examines all 4 interface...

must I use 2 distinct instaces of snort?

----------

## hanj

I'm wondering if you can set it to listen on 'all' interfaces in (/etc/conf.d/snort), but then configure it via /etc/snort/snort.conf to pay attention to the interfaces you want.

```

# or use global variable $<interfacename>_ADDRESS which will be always

# initialized to IP address and netmask of the network interface which you run

# snort at. 

var HOME_NET [$eth0_ADDRESS,$eth1_ADDRESS]
```

I just tried this.. but it doesn't look like it works too hot.. but wanted to post it just in case I missed something stupid.

Another option is to configure your HOME_NET with just the IPs of the two interfaces you want...

```
var HOME_NET [192.168.0.0/24, 10.0.0.0/24]
```

HTH

hanji

----------

## tdi

snort is not designed to be HOST based IDS. 

it Net based ids. 

it should have seperate machine on the door of the network. 

like this: 

-------snort machine -----------router ---------- server-----(network) 

it should be like spy... only listen and invisble

----------

## capitanjackal

 *mrfree wrote:*   

> I have 4 network interface on my home-server and I want snort sniffs only 2 of them
> 
> ```
> # Config file for /etc/init.d/snort
> 
> ...

 

with IFACE=any I can't reach to make snort working

It starts but the interfaces don't go in promiscuos.

In the snort FAQ they talk about a patch

http://www.snort.org/docs/faq/1Q05/node35.html

I need to make work snort in both interfaces, one in the lan side and the other in the wan side,

any idea ?

thanks

Giacomo

----------

