[Snort-users] Multi-process Snort

Peter Bates peter.bates at ...15381...
Fri Aug 17 07:43:00 EDT 2012


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi all

On 17/08/2012 12:12, Pratik Narang wrote:
> Thanks to Joel, Robert and others for the help. When we talk of a
> multi-process Snort, we are talking of multiple instances of Snort
> over different cores, right? How is the Pre-processor based engine
> and the detection engine then balanced between the different
> instances of Snort? Is it like one instance takes care of 10K
> rules, the other of 12K rules and something like that?

There may be other ways of achieving the goal - but the PF_RING
example works by spreading the traffic across the instances - each
instance is the same, with all rules loaded and the same configuration
(apart of course from where it alerts to).

Other than Martin Holste's blog as previously linked, also see:
http://www.metaflows.com/technology/pf-ring/
http://www.metaflows.com/technology/10-gbps-pf_ring-2/

- -- 
Peter Bates
Senior Computer Security Officer    Phone: +44(0)2076792049
Information Services Division	    Internal Ext: 32049
University College London
London WC1E 6BT
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJQLi5EAAoJELhVoVpEMS6RZj4IAIqYksiP/ZQ5YaTRYZPY3Q8X
uuHychfMdfkdBvsBjSmwiWLHF6XGi/ywNzXrxBZ7NDsAIsycl379EQkAYpGpOioJ
sfNbfWIrl90RoKiFEjjCr/Z5AeOs8AfjZqzyqKyJ/Q90pCfji2awAN5NOBwiAY6E
ZB4MXbUctwFc4v4tLliBE7Kya66wCgB4asC02DC45D+lpGSJzeiMPY6q/JYYj+lJ
W3BJxKC8/Nm96v1tQdFukV3wuwbLdaU6LD9sbvSvY2xjt9OdVuE0bR1GgGxC24F0
ARXs5x5mDALakoVNxRDHgvaCM65+uVq77OdPHBXSXhjM5KmTj/jbd3+7Y4kHMOI=
=32B0
-----END PGP SIGNATURE-----





More information about the Snort-users mailing list