[Snort-users] Threaded Snort
gbinder at ...462...
Mon Mar 19 14:01:45 EST 2001
Frank Knobbe on Mon, Mar 19, 2001 at 10:59:49AM -0600:
> No, but depending on your traffic pattern and network layout, you can
> use filtering via BPF and set up multiple hosts (not just CPUs) with
> snort. Host A would have the traffic filtered to... let's say half
> your subnet, while host B is filtering for the invert of host A.
Has anybody tested how well this mechanism scales at all? Since every
packet will be read twice, I'd expect it to be of very limited help for
distributing load among several instances of snort.
Gregor Binder <gregor.binder at ...462...> http://sysfive.com/
sysfive.com GmbH UNIX. Networking. Security. Applications.
PGP id: 0x20C6DA55 fp: 18AB 2DD0 F8FA D710 1EDC A97A B128 01C0 20C6 DA55
More information about the Snort-users