[Snort-users] CPU pegged for unknown reasons

Scott Finlon scott.finlon at ...15821...
Wed Jul 17 14:50:14 EDT 2013


I am in the process of moving Snort from an older box to a new box. Both
are RHEL 6 x64, both with the same NICs.
I am using PF_RING/DNA to split traffic across CPU cores on the box, and
can verify using PF_RINGs tool that traffic is being split the way it
should be.

I compiled Snort on the new box fresh, but copied the configs over. The
old box CPU is currently sitting around 10%, the new box has the cores
pegged at 99-100%.

At Beenph's request, I disable HT on the new box, but the CPU is still
maxed.

Any other ideas of what might be causing this to happen?

Scott Finlon, CISSP GCIA
-----------------------------------
Information Security Engineer
The University of Scranton
email : scott.finlon at ...15821...
phone : 570-941-6168
-----------------------------------







More information about the Snort-users mailing list