Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Absolutely. Specifically "promiscuous" mode is just a flag on the network stack that passes all packets seen on that interface up to the application layer. Using snort as an example, this is often how one will properly monitor multi-homed systems. One NIC monitoring each uplink.

Using snort as your IDS, please be careful with how it handles interface specifications. The interface option will accept only a single argument, either a specific interface or any. The trouble with any is that it will cause the process to listen on all interfaces, including loopback. Additionally, snort is single threaded (expected to change with version 3.0). I would highly recommend running multiple instances of snortd, each listening on a single interface. How this is accomplished will depend on your distribution. On RedHat based systems edit the file /etc/sysconfig/snort and populate the INTERFACE variable. For example, if you use eth1 and eth2 for monitoring you would use

INTERFACE="eth2 eth3"

The init script will automagically launch a separate process for each interface listed.

share|improve this answer
    
Hi packs, yes I'm specifically wondering if I can achieve that in Snort IDS. I'll try fitting another network card and set it to run on promiscuous and see how it goes. Thanks a lot. –  Fred1234 Mar 18 '11 at 1:20
1  
@FredY I've run a snort sensor with as many as 4 nics, caveat being with the way snort handles interface specs. I'll update my answer with the info. –  Scott Pack Mar 18 '11 at 1:24
    
Brilliant! Thanks a lot! –  Fred1234 Mar 18 '11 at 1:38

Yes you can.

I've had two wireless cards in promiscuous mode sniffing two different channels at the same time.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.