[Snort-users] Snort CPU usage

Mike Miller mike at ...16027...
Mon Feb 18 20:01:18 EST 2013


I believe they solved the problem by dodging it. Rather than multi-threading snort, they use PF_RING to get access closer to the hardware, and does so in a way that multiple threads running the same config will get access to separate packets (I'm still coming up to speed on it).

There are also PF_RING aware NICS that greatly improve processing....and I believe Suricata is multi-threaded, but I haven't used it yet, myself. 






On Feb 18, 2013, at 3:39 PM, Josh Bitto <jbitto at ...16055...> wrote:

> I’m bumping this back up…..I’m curious to hear. Is snort still only single threaded on a CPU or have newer versions allowed it to run on more than one core?
>  
> I’m wanting to make sure I have enough machine to run my WAN and about 4 VLANs
>  
> Each would have an interface to monitor, but where I’m stuck is the rule sets…
>  
> I read online where a great determining calculation is this…
> 1 CPU = (1000 signatures ) * (500 megabits network traffic)
>  
> So my question would be….if each interface has its own rule set aside from the main download of rules. Does that factor in?
>  
>  
>  
> From: Josh Bitto [mailto:jbitto at ...16055...] 
> Sent: Monday, February 18, 2013 8:29 AM
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] Snort CPU usage
>  
> Does anyone have a url or program where I can calculate hardware requirements for running snort on my network?
>  
>  
> ------------------------------------------------------------------------------
> The Go Parallel Website, sponsored by Intel - in partnership with Geeknet, 
> is your hub for all things parallel software development, from weekly thought 
> leadership blogs to news, videos, case studies, tutorials, tech docs, 
> whitepapers, evaluation guides, and opinion stories. Check out the most 
> recent posts - join the conversation now. http://goparallel.sourceforge.net/_______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130218/5686d789/attachment.html>


More information about the Snort-users mailing list