[Snort-users] Pin snort single processor

JJ Cummings cummingsj at ...11827...
Tue Apr 6 11:47:22 EDT 2010


Most typically for load distribution on a multi-core system.. So what I mean
by this: you have two cores and a big network with loads of traffic, use a
bpf and two snort instances (each pinned to a different core) to segment the
monitoring of this large and noisy network to two (or more) snort instances
and CPUs...

JJC

On Tue, Apr 6, 2010 at 9:39 AM, Jason Wallace <jason.r.wallace at ...11827...>wrote:

> I remember seeing a conversation about pinning the snort process to a
> single CPU/core. Looking back I found the thread that talked about how
> to do this, but I could not find the conversation about _why_ this
> should be done.
>
> What is the actual undesired results of not pinning the process to a single
> CPU?
>
> Thx,
> Wally
>
>
> ------------------------------------------------------------------------------
> Download Intel® Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100406/7fceaaf5/attachment.html>


More information about the Snort-users mailing list