[Snort-users] Snort in a cluster

Brian bmc at ...950...
Fri Jul 9 06:28:00 EDT 2004


On Fri, Jul 09, 2004 at 08:41:18AM -0300, Luis Claudio Rodrigues da Silveira wrote:
> Hi all,
> 
> is it possible to setup a beowulf cluster running many snort sensors
> at once? Is there any advantage in terms of performance on packet
> processing??

Eric, are you listening?  This question needs to be added to the
drinking game.  Since it is fairly rare, but wacked in its own right,
I think a "full slam" is appropriate.

To answer your question, NO.  IDS is not something that beowulf
clustering is useful for.  Read up on beowulf clusters and you will
see that they are best suited for trivially parallelized tasks.

NIDS is not easily parallelized.

Brian




More information about the Snort-users mailing list