RE: snort and bonding

["Scott Williams (Network)" <Sawilliams () mdch com>]

I use bonding quite a bit with snort on RH7.3. The downside is that I can
only seem to create one bond interface per sensor. 

-----Original Message-----
From: Michael Boman [mailto:michael.boman () securecirt com] 
Sent: Saturday, March 08, 2003 11:03 PM
To: Patrice Boulanger
Cc: snort-users () sourceforge net
Subject: Re: [Snort-users] snort and bonding


On Fri, Mar 07, 2003 at 06:38:23PM +0100, Patrice Boulanger wrote:
> Hello everyone,
>
> Does anyone have already used snort with network interface bonding ? 
> Is it easy to use such an interface to be able to listen more traffic 
> (for example by using 4 interfaces to listen up to 400Mbits of 
> traffic) ?
>
> Thanks

Bonding is useful when you are using taps. To use 4 NIC's to sniff 400 Mbps
is doable, but more concideration has to be given to load-balancing, BPF
filters etc... What exactly are you trying to do?

/Mike

-- 
Michael Boman
Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com


-------------------------------------------------------
This SF.net email is sponsored by: Does your code think in ink? 
You could win a Tablet PC. Get a free Tablet PC hat just for playing. 
What are you waiting for?
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users