interface bonding

[Richard Bejtlich]

Hello,

I operate http://taosecurity.blogspot.com and
http://www.taosecurity.com.

I posted a method to use ng_one2many for bonding
interfaces here in June:

http://marc.theaimsgroup.com/?l=snort-users&m=105585533810122&w=2

That method relies on three real interfaces: the two
to be bonded and a third against which traffic is
mirrored.

I've not had luck creating a third "virtual" interface
against which to sniff.

Using ng_fec, however, a fec0 interface us created
automatically.  That's what I'm using now on my NSM
sensor and it works fine.

I appreciate any hints on creating a virtual interface
to use for sniffing with ng_one2many.   If you can
help me do that I'll use ng_one2many instead of
ng_fec.  ng_fec doesn't have a man page, which is
enough for me to avoid it if possible.  :)

Thank you,

Richard
http://www.taosecurity.com



__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/