4

I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?

5

Absolutely. Specifically "promiscuous" mode is just a flag on the network stack that passes all packets seen on that interface up to the application layer. Using snort as an example, this is often how one will properly monitor multi-homed systems. One NIC monitoring each uplink.

Using snort as your IDS, please be careful with how it handles interface specifications. The interface option will accept only a single argument, either a specific interface or any. The trouble with any is that it will cause the process to listen on all interfaces, including loopback. Additionally, snort is single threaded (expected to change with version 3.0). I would highly recommend running multiple instances of snortd, each listening on a single interface. How this is accomplished will depend on your distribution. On RedHat based systems edit the file /etc/sysconfig/snort and populate the INTERFACE variable. For example, if you use eth1 and eth2 for monitoring you would use

INTERFACE="eth2 eth3"

The init script will automagically launch a separate process for each interface listed.

  • Hi packs, yes I'm specifically wondering if I can achieve that in Snort IDS. I'll try fitting another network card and set it to run on promiscuous and see how it goes. Thanks a lot. – Fred1234 Mar 18 '11 at 1:20
  • 1
    @FredY I've run a snort sensor with as many as 4 nics, caveat being with the way snort handles interface specs. I'll update my answer with the info. – Scott Pack Mar 18 '11 at 1:24
0

Yes you can.

I've had two wireless cards in promiscuous mode sniffing two different channels at the same time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.