[Snort-users] 10GbE & 40GbE Support for Multiple Parallel Snort Instances

Joel Esler (jesler) jesler at ...589...
Mon Aug 25 17:21:53 EDT 2014


You may not be aware, but we do not really allow direct marketing or advertising to the Snort community via the mailing lists.

Joel Esler
Open Source Manager
Threat Intelligence Team Lead

On Aug 25, 2014, at 5:12 PM, Scott Schweitzer <schweitzer.scott at ...11827...<mailto:schweitzer.scott at ...11827...>> wrote:

If you are seeking a method to support multiple parallel instances of Snort on a 10GbE or 40GbE interface you might want to consider Solarflare’s SolarCapture on their Flareon adapter line.  SolarCapture has a feature that supports application clustering that supports N instances of Snort up to the total number of cores in the server, then it uses Receive Flow Steering (advanced form of RSS) to spread flows across cores (based on a tuple hash).

It also can make a single copy of the incoming traffic so you can sniff packets into a libpcap compliant, clustered Snort environment while still delivering the packets to kernel for their initial destination. To learn more check out this link<http://www.solarflare.com/SolarCapture-Packet-Capture-Software>, or contact me for the User’s Guide.

-- Scott Schweitzer

Slashdot TV.
Video for Nerds.  Stuff that matters.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140825/ea2ebc8f/attachment.html>

More information about the Snort-users mailing list