[Snort-users] Snort on two load-balanced links (using SPAN on a Cisco 6500)

Tristan RHODES TristanRhodes at ...13277...
Wed Apr 27 07:59:25 EDT 2005


I am considering using Snort to monitor two uplinks on a Cisco 6500 into
the core.  This will be done using SPAN to mirror the traffic on both
uplinks to single port.  Assume that bandwidth is not a problem.

These are equal-cost routes, so traffic will be load-balanced by OSPF. 
(I think this is load-balanced by flow, not per packet).

Does anyone know what the effect this setup (load-balanced links) will
have on the ability of Snort to do it's job?

Tristan Rhodes




More information about the Snort-users mailing list