Can you have 2 promiscuous (sniffing) ports on a single machine?

Question

I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?

Answer 1

Absolutely. Specifically "promiscuous" mode is just a flag on the network stack that passes all packets seen on that interface up to the application layer. Using snort as an example, this is often how one will properly monitor multi-homed systems. One NIC monitoring each uplink.

Using snort as your IDS, please be careful with how it handles interface specifications. The interface option will accept only a single argument, either a specific interface or any. The trouble with any is that it will cause the process to listen on all interfaces, including loopback. Additionally, snort is single threaded (expected to change with version 3.0). I would highly recommend running multiple instances of snortd, each listening on a single interface. How this is accomplished will depend on your distribution. On RedHat based systems edit the file /etc/sysconfig/snort and populate the INTERFACE variable. For example, if you use eth1 and eth2 for monitoring you would use

INTERFACE="eth2 eth3"

The init script will automagically launch a separate process for each interface listed.

Answer 2

Yes you can.

I've had two wireless cards in promiscuous mode sniffing two different channels at the same time.