[Snort-users] Snort in a cluster

Alex Butcher, ISC/ISYS Alex.Butcher at ...11254...
Fri Jul 9 06:02:13 EDT 2004


--On 09 July 2004 08:41 -0300 Luis Claudio Rodrigues da Silveira 
<lsilveira at ...11391...> wrote:

> is it possible to setup a beowulf cluster running many snort sensors at
> once? Is there any advantage in terms of performance on packet
> processing??

AFAIK, Snort is not coded in such a way as to take advantage of extra 
machines (or even extra CPUs in a multi-CPU machine).

If you need more power for snort than a single CPU can provide, you 
probably want to be looking at having multiple sensors and a IDS 
load-balancing solution (e.g. Radware or Top Layer).

> Thanks in advance,
> Luis Claudio R da Silveira

Best Regards,
Alex.
-- 
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9






More information about the Snort-users mailing list