[Snort-users] Threaded Snort

Frank Knobbe FKnobbe at ...649...
Mon Mar 19 19:48:10 EST 2001


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> -----Original Message-----
> From: Gregor Binder [mailto:gbinder at ...462...]
> Sent: Monday, March 19, 2001 1:02 PM
> 
> Has anybody tested how well this mechanism scales at all? Since
> every packet will be read twice, I'd expect it to be of very 
> limited help for
> distributing load among several instances of snort.
> 
> Any numbers?


I don't have any numbers, but the packets that don't pass the BPF
filter don't get analyzed by snort and discarded early. That should
improve performance quite well.

I'm interested in numbers as well.... Anyone?

Frank

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.8
Comment: PGP or S/MIME encrypted email preferred.

iQA/AwUBOraoypytSsEygtEFEQKwDgCeOwjAJdEzLZOzFZqnnYMYkic3i4UAnifM
x/+/AaauCSydW3kdE+XvI99V
=W72Q
-----END PGP SIGNATURE-----




More information about the Snort-users mailing list