Running Snort 3 on multiple VLANs
Oren Kirchhoff via Snort-users <[email protected]> Wed, 25 Feb 2026 22:20:15 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <SA0PR11MB476882250542CA3CA29BC45FD175A@SA0PR11MB4768.namprd11.prod.outlook.com> |
--===============2755308922685328866== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_SA0PR11MB476882250542CA3CA29BC45FD175ASA0PR11MB4768namp_" --_000_SA0PR11MB476882250542CA3CA29BC45FD175ASA0PR11MB4768namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello everyone! I am new to Snort 3 and we are preparing to build Snort Servers to monitor = a few different VLANs that are on their own network interface. We will hav= e this same setup at about 3 other sites and that data will be sent to a Wa= zuh server. When configuring snort 3 to passively monitor each network int= erface/VLAN, should we run one instance of snort and have it monitor the th= ree different VLANs, or should we have a separate instance for each VLAN? Oren Kirchhoff - Computer Services - Information Security Specialist - Phone: 660-263-4100 x11348 - Email: [email protected] --_000_SA0PR11MB476882250542CA3CA29BC45FD175ASA0PR11MB4768namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:sc= hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of= fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Aptos;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:12.0pt; font-family:"Aptos",sans-serif; mso-ligatures:standardcontextual;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Aptos",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style> </head> <body lang=3D"EN-US" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:= break-word"> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Hello everyone!<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">I am new to Snort 3 and we are preparing to build Sn= ort Servers to monitor a few different VLANs that are on their own network = interface. We will have this same setup at about 3 other sites and th= at data will be sent to a Wazuh server. When configuring snort 3 to passively monitor each network interface/VLAN,= should we run one instance of snort and have it monitor the three differen= t VLANs, or should we have a separate instance for each VLAN? <o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:black;mso-ligatures:none">Oren Kirchhoff</span= ><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-serif= ;color:black;mso-ligatures:none"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:black;mso-ligatures:none"><o:p> </o:p></s= pan></p> </div> <div> <p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"= ;Calibri",sans-serif;color:black;mso-ligatures:none">- Computer Servic= es - Information Security Specialist</span></b><span style=3D"font-size:11.= 0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:no= ne"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"= ;Calibri",sans-serif;color:black;mso-ligatures:none">- Phone:</span></= b><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-seri= f;color:black;mso-ligatures:none"> 660-263-4100 x11348</span><span sty= le=3D"font-size:11.0pt;font-family:"Calibri",sans-serif;color:bla= ck;mso-ligatures:none"><o:p></o:p></span></p> </div> <p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"= ;Calibri",sans-serif;color:black;mso-ligatures:none">- Email:</span></= b><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-seri= f;color:black;mso-ligatures:none"> [email protected]</span><o:p></o:p></p= > </div> </body> </html> --_000_SA0PR11MB476882250542CA3CA29BC45FD175ASA0PR11MB4768namp_-- --===============2755308922685328866== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============2755308922685328866==--