[Snort-users] Using Snort in Virtual Machines with PF_RING
aymacro at ...11827...
Wed Mar 13 11:22:07 EDT 2013
Gents & Ladies,
I've been reading a lot on PF_RING integration into Snort, and I do have a
question which I think community may be able to help.
I have a HP DL380 Dual Quad Core which has 2 virtual machines running with
4 Cores each. These VMs have 3 interfaces where 2 are being used for
sniffing and 1 for mngt. Now my question is, should I place PF_RING on the
Host machine or should it be placed on each Snort VM?
Since PF_RING load balances traffic from multiple Snort instances on a
single interface, it becomes a little confusing on how to proceed. If this
works out, I would be glad to create an article to help folks out there.
Thanks in advance for your responses.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users