[Snort-users] Snort on two load-balanced links (using SPAN on a Cisco 6500)
TristanRhodes at ...13277...
Wed Apr 27 07:59:25 EDT 2005
I am considering using Snort to monitor two uplinks on a Cisco 6500 into
the core. This will be done using SPAN to mirror the traffic on both
uplinks to single port. Assume that bandwidth is not a problem.
These are equal-cost routes, so traffic will be load-balanced by OSPF.
(I think this is load-balanced by flow, not per packet).
Does anyone know what the effect this setup (load-balanced links) will
have on the ability of Snort to do it's job?
More information about the Snort-users