[Snort-users] CPU pegged for unknown reasons

Scott Finlon scott.finlon at ...15821...
Wed Jul 17 14:50:14 EDT 2013

I am in the process of moving Snort from an older box to a new box. Both
are RHEL 6 x64, both with the same NICs.
I am using PF_RING/DNA to split traffic across CPU cores on the box, and
can verify using PF_RINGs tool that traffic is being split the way it
should be.

I compiled Snort on the new box fresh, but copied the configs over. The
old box CPU is currently sitting around 10%, the new box has the cores
pegged at 99-100%.

At Beenph's request, I disable HT on the new box, but the CPU is still

Any other ideas of what might be causing this to happen?

Scott Finlon, CISSP GCIA
Information Security Engineer
The University of Scranton
email : scott.finlon at ...15821...
phone : 570-941-6168

More information about the Snort-users mailing list