[Snort-users] Snort in a cluster

Alex Butcher, ISC/ISYS Alex.Butcher at ...11254...
Thu Jul 15 03:17:07 EDT 2004

--On 12 July 2004 06:38 -0400 Michael Stone <mstone+snort at ...10946...> wrote:

>>> I've had good success running multiple snorts on one system where each
>>> sees part of the traffic and together they can keep up with a faster
>>> link  than a single process trying to watch everything.
>> I won't deny your experience, but that doesn't make much sense! *shrug*
> It doesn't make sense that dividing a traffic stream in half and giving
> each half its own processor allows more traffic to be monitored than
> trying to watch the same traffic with a single processor?

Ah, multi-processor hardware. Makes perfect sense, now. ;-)

> Mike Stone

Best Regards,
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9

More information about the Snort-users mailing list