[Snort-users] Pin snort single processor

Edward Bjarte Fjellskål edward.fjellskal at ...14590...
Tue Apr 6 12:34:58 EDT 2010


Jason Wallace wrote:
> OK so there is no affect on tracking frags, state, or anything else
> that might adversely affect detection. It is just a performance
> recommendation for folks using more than one instance of Snort?

I would say its a performance recommendation for folks concerned
about performance regardless of # of snort instances :)
It does not affect detection other than it might help on lowering
your packet-loss rate (if you have any).

Snort should stick to one CPU preferably for optimal performance.
That said, there are other ways to tweak snort that should be
done first. Also, if you dont have any performance issues, you
dont have to tune anything :)

Ref:
http://www.gamelinux.org/?p=81


> 
> Thx,
> Wally




More information about the Snort-users mailing list