[Snort-users] Snort in a cluster
Alex Butcher, ISC/ISYS
Alex.Butcher at ...11254...
Thu Jul 15 03:17:07 EDT 2004
--On 12 July 2004 06:38 -0400 Michael Stone <mstone+snort at ...10946...> wrote:
>>> I've had good success running multiple snorts on one system where each
>>> sees part of the traffic and together they can keep up with a faster
>>> link than a single process trying to watch everything.
>> I won't deny your experience, but that doesn't make much sense! *shrug*
> It doesn't make sense that dividing a traffic stream in half and giving
> each half its own processor allows more traffic to be monitored than
> trying to watch the same traffic with a single processor?
Ah, multi-processor hardware. Makes perfect sense, now. ;-)
> Mike Stone
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9
More information about the Snort-users