[Snort-users] Snort with SingleStream device?

Michael Stone mstone+snort at ...10946...
Tue Feb 1 10:26:23 EST 2005


On Tue, Feb 01, 2005 at 09:07:41AM -0600, Eric Hines wrote:
>The Port Aggregators allow you to no longer have to do port bonding in Linux
>on a Snort sensor, eliminating having to waste a second NIC. The Port Aggs
>bond the A and B ports together in to a single monitoring port on the Tap.

Of course, if you actually use a full duplex 100M link you're going to
run into trouble unless the port aggregator magically fits 200M of
traffic down a 100M pipe...

Mike Stone




More information about the Snort-users mailing list