[Snort-users] Pin snort single processor

Jason Wallace jason.r.wallace at ...11827...
Tue Apr 6 11:53:36 EDT 2010

OK so there is no affect on tracking frags, state, or anything else
that might adversely affect detection. It is just a performance
recommendation for folks using more than one instance of Snort?


On Tue, Apr 6, 2010 at 11:47 AM, JJ Cummings <cummingsj at ...11827...> wrote:
> Most typically for load distribution on a multi-core system.. So what I mean
> by this: you have two cores and a big network with loads of traffic, use a
> bpf and two snort instances (each pinned to a different core) to segment the
> monitoring of this large and noisy network to two (or more) snort instances
> and CPUs...
> On Tue, Apr 6, 2010 at 9:39 AM, Jason Wallace <jason.r.wallace at ...11827...>
> wrote:
>> I remember seeing a conversation about pinning the snort process to a
>> single CPU/core. Looking back I found the thread that talked about how
>> to do this, but I could not find the conversation about _why_ this
>> should be done.
>> What is the actual undesired results of not pinning the process to a
>> single CPU?
>> Thx,
>> Wally
>> ------------------------------------------------------------------------------
>> Download Intel® Parallel Studio Eval
>> Try the new software tools for yourself. Speed compiling, find bugs
>> proactively, and fine-tune applications for parallel performance.
>> See why Intel Parallel Studio got high marks during beta.
>> http://p.sf.net/sfu/intel-sw-dev
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.php3?list=snort-users

More information about the Snort-users mailing list