I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
Absolutely. Specifically "promiscuous" mode is just a flag on the network stack that passes all packets seen on that interface up to the application layer. Using snort as an example, this is often how one will properly monitor multi-homed systems. One NIC monitoring each uplink.
Using snort as your IDS, please be careful with how it handles interface specifications. The interface option will accept only a single argument, either a specific interface or
The init script will automagically launch a separate process for each interface listed.
Yes you can.
I've had two wireless cards in promiscuous mode sniffing two different channels at the same time.