[Snort-devel] Race Conditions

Blyth A J C (Comp) ajcblyth at ...1255...
Tue May 7 05:32:04 EDT 2002


One a network we have several intrusion detection systems running. How do
you get round the problem of two snort systems detecting the same event at
the same time and reporting it to the data base. If the signature had not
been seen before that both sensors would attempt to insert the signature for
the first time. One would succedd and one would have. On the console of the
system that failed an error message would be created. So how do you stop
this race conditon?


Andrew




More information about the Snort-devel mailing list