[Snort-users] Using Snort in Virtual Machines with PF_RING

Ayodele Okeowo aymacro at ...11827...
Wed Mar 13 15:12:13 EDT 2013

After some research, I stumbled on some article. (e.g.
http://seclists.org/snort/2012/q3/978) but I wouldn't mind any addition
information anyone wants to share.


On Wed, Mar 13, 2013 at 11:22 AM, Ayodele Okeowo <aymacro at ...11827...> wrote:

> Gents & Ladies,
> I've been reading a lot on PF_RING integration into Snort, and I do have a
> question which I think community may be able to help.
> I have a HP DL380 Dual Quad Core which has 2 virtual machines running with
> 4 Cores each. These VMs have 3 interfaces where 2 are being used for
> sniffing and 1 for mngt. Now my question is, should I place PF_RING on the
> Host machine or should it be placed on each Snort VM?
> Since PF_RING load balances traffic from multiple Snort instances on a
> single interface, it becomes a little confusing on how to proceed. If this
> works out, I would be glad to create an article to help folks out there.
> Thanks in advance for your responses.
> Ayo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130313/2334e241/attachment.html>

More information about the Snort-users mailing list