[Snort-users] Threaded Snort

Gregor Binder gbinder at ...462...
Mon Mar 19 14:01:45 EST 2001

Frank Knobbe on Mon, Mar 19, 2001 at 10:59:49AM -0600:

> No, but depending on your traffic pattern and network layout, you can
> use filtering via BPF and set up multiple hosts (not just CPUs) with
> snort. Host A would have the traffic filtered to... let's say half
> your subnet, while host B is filtering for the invert of host A.

Has anybody tested how well this mechanism scales at all? Since every
packet will be read twice, I'd expect it to be of very limited help for
distributing load among several instances of snort.

Any numbers?


Gregor Binder       <gregor.binder at ...462...>      http://sysfive.com/
sysfive.com GmbH               UNIX. Networking. Security. Applications.
PGP id: 0x20C6DA55 fp: 18AB 2DD0 F8FA D710 1EDC A97A B128 01C0 20C6 DA55

More information about the Snort-users mailing list