[Snort-users] half the net for multiple snort processes
jfarshch at ...3199...
Wed Nov 14 14:23:03 EST 2001
We want to utilize two processors by halving the possible addresses that
each snort process will monitor. For instance, we want one processor (and
subsequently one snort process) to monitor half of all the possible
Internet addresses and then have another processor monitor the rest. We are
currently suffering from an ~20 - 30% packet loss on our machines and we
believe that by doing this, we can substantially decrease packet loss
because at any given time, one of the processors is virtually unused.
1. How would we specify this configuration in the snort.conf files? I think
that the simplest way would be to specify it in the HOME_NET variable, but how?
2. Will this configuration actually decrease the packet loss we are
Any suggestions would be greatly appreciated.
Jamil D. Farshchi
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users