[Snort-users] Threaded Snort

Erik Engberg Erik.Engberg at ...511...
Tue Mar 20 11:13:37 EST 2001

>Gregor Binder       <gregor.binder at ...462...>   

>If you are using SnortSnarf on the same box, it will help in that
>running it will have less or no (if you are running an operating system
>that can bind processes to a certain CPU) impact on the running snort
>instance. The point is, additional programs running on your sensor will
>be scheduled to run on the other CPU if the one snort uses is busy.

What OS:s allow you to do this binding? For instance, if I would like to
dedicate a CPU (and a scsi disk) to snort, and let the other CPU (and scsi
disk, even controller) do the rest of the box need and maybe the snort db,
apache etc. 

Also, could I take a 4xCPU box and run 4 instances of Snort on it, on 4 NICs
(or a quad nic)?

Would any of this be of feasible/usable?


More information about the Snort-users mailing list