Re: [Snort-inline-users] Running multiple snortinline on same interface

[Nick R. <ni...@ro...>]

> This is a ip_queue limitation, not a snort-inline limitation. NFQUEUE
> which will be included in the 2.6.14 kernel will support multiple
> queue targets, hence you will be able to run multiple instances of
> snort-inline once we add support for it ;-).
>

   If your application is not platform specific, you could accomplish this
with snort_inline on FreeBSD (which doesn't have this limitation).


> Regards,
>
> Will
>
> On 8/19/05, Sanjai Narain <na...@re...> wrote:
>> We have two independently developed snortinline applications that we'd
>> now
>> like to run on the same interface. Is this possible via snort
>> configuration, or do we have to merge the source code in the
>> preprocessors
>> directory and rebuild a single application? I would greatly appreciate
>> any
>> assistance.
>>
>> We tried starting up both snort binaries on the same interface but got
>> an
>> error (I believe it was resource busy).  However, if we run two copies
>> of
>> the non-inline Snort applications on the same interface, there is no
>> error.
>>
>> Thanks. --
>> Sanjai Narain
>> Senior Research Scientist
>> Telcordia Technologies
>>
>>
>>
>>


Nick Rogness <ni...@ro...>