[Snort-users] Multi-process Snort

Marcos Rodriguez marcos.e.rodriguez at ...11827...
Tue Aug 14 11:28:50 EDT 2012


On Tue, Aug 14, 2012 at 11:19 AM, Pratik Narang
<pratik.cse.bits at ...11827...>wrote:

> Could the Sourcefire guys or experienced users throw some light on
> scaling on Snort at high bandhwidths (order of GBps) by using a
> multi-core system (4/8/16 cores) and running Snort as a multi-process?
> Maybe someone could direct me to research papers or white papers...
>
>
>
Hi Pratik,

I would suggest Martin Holste's blog as a starting point:
http://ossectools.blogspot.com/2011/07/running-load-balanced-snort-in-pfring.html

It's a nice write-up and you can start experimenting quickly.   Hope this
helps!

marcos
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120814/9cef85b9/attachment.html>


More information about the Snort-users mailing list