RE: [Snort-users] Win32 - multiple interfaces?

Running two Snort services may be as simple as editing the original registry
key for the first instance of Snort, and then run another instance of the
'/SERVICE /INSTALL' command to add it again, being careful not to overwrite
the first instance.

You could also use another service tool like firedeamon or the Microsoft
files you described below.

Note: BACKUP your registry so you can revert back if something gets blown
out.

Kindest regards,

The WINSNORT.com Management Team
--
Pick up your FREE Windows or UNIX Snort installation guides
mailto:support@winsnort.com
Website: http://www.winsnort.com
Snort: Open Source Network IDS - http://www.snort.org


> -----Original Message-----
> From: snort-users-admin@lists.sourceforge.net [mailto:snort-users-
> admin@lists.sourceforge.net] On Behalf Of Rich Adamson
> Sent: Thursday, January 01, 2004 1:09 PM
> To: 'Snort Users List'; Scot Scot
> Subject: Re: [Snort-users] Win32 - multiple interfaces?
>
> Hi Scot,
>
> > > Thanks Mike..
> > >
> > > > Q1: You can't detect two interfaces with one Snort instance.
> > > >
> > > > Note: Throw some more RAM in and run 2 Snorts
> > >
> > > I'm going to set up one instance to run as a Service. Are your
> > instructions
> > > at your site now?
> > >
> > > When that's all done, looks like I'll take another run at updating
> > > the README.WIN32 stuff. Been a few changes since I wrote that original
> > > one. :)
> > >
> > > Rich
> > >
> > <snip>
> >
> > How about running both instances as a service?
> >
> > Here is a recommendation:
> >
> > Use instsrv.exe and srvany.exe from the NT Resource kit
> >
> > Step-1, execute the following commands:
> >
> > instsrv srvany %windir%\srvany.exe
> > instsrv snort1 %windir%\srvany.exe
> > instsrv snort2 %windir%\srvany.exe
> >
> > Step-2, build two .reg files for each snort instance and import them
> into
> > the registry:
> > (You will have to fill in the %%'s with your own values)
>
> Wouldn't it actually be easier to have a snort1.exe and snort2.exe and
> config both to run as a Service? (I haven't tried this, so not sure it
> would actually work.)
>
> Rich
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: IBM Linux Tutorials.
> Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
> Free Linux Tutorials. Learn everything from the bash shell to sys admin.
> Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...st=snort-users




-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users