[Snort-devel] Inter-Sensor Communication? (long)

Fyodor fygrave at ...1...
Sun May 20 15:23:05 EDT 2001


> 
> You mean as broadcasts? Would work, but I think reliability would be
> desired. If you'd use directed packets, you still have 19^2 packets
> floating around. I think the question is, should inter-sensor
> communication be implemented in a mesh (mess?), or by utilizing a
> master/controller host? (This is assuming that all sensors see the
> traffic and respond, as in worst-case. If only one sensor responds,
> it would be only 19 packets/conns)
> 

Actually what I was thinking of in the original snortnet
design is kind of tree scheme, where tree nodes which follow
sensors, would be able to decrease/summarise the amount of
data which is floating towards the master node. The idea is
still 'in the air', since I haven't done much coding on it
yet.
 





More information about the Snort-devel mailing list