Re: [Snort-inline-users] Running multiple snortinline on same interface

[Sanjai N. <na...@re...>]

Nick: Thanks for pointing this out. We are running on Linux only, but your 
point is quite interesting. Regards. -- Sanjai



On Sun, 21 Aug 2005, Nick Rogness wrote:

>
>> This is a ip_queue limitation, not a snort-inline limitation. NFQUEUE
>> which will be included in the 2.6.14 kernel will support multiple
>> queue targets, hence you will be able to run multiple instances of
>> snort-inline once we add support for it ;-).
>>
>
>   If your application is not platform specific, you could accomplish this
> with snort_inline on FreeBSD (which doesn't have this limitation).
>
>
>> Regards,
>>
>> Will
>>
>> On 8/19/05, Sanjai Narain <na...@re...> wrote:
>>> We have two independently developed snortinline applications that we'd
>>> now
>>> like to run on the same interface. Is this possible via snort
>>> configuration, or do we have to merge the source code in the
>>> preprocessors
>>> directory and rebuild a single application? I would greatly appreciate
>>> any
>>> assistance.
>>>
>>> We tried starting up both snort binaries on the same interface but got
>>> an
>>> error (I believe it was resource busy).  However, if we run two copies
>>> of
>>> the non-inline Snort applications on the same interface, there is no
>>> error.
>>>
>>> Thanks. --
>>> Sanjai Narain
>>> Senior Research Scientist
>>> Telcordia Technologies
>>>
>>>
>>>
>>>
>
>
> Nick Rogness <ni...@ro...>
>
>