[Snort-devel] Snort multithread

Xiong Wu xiong.wu1981 at ...2499...
Thu Jul 14 21:05:53 EDT 2011

I know the user is able to run multiple snort instances with network
load balance on multiple cores platform.

Some preprocessors such as "sfportscan"  and "threshold" have to see
the global network packets to work correctly.
However in load balance mode, each snort instance can only see a piece
of global network packets.

Is there any idea to resolve this issue.


More information about the Snort-devel mailing list