Snort mailing list archives
Snort on two load-balanced links (using SPAN on a Cisco 6500)
From: "Tristan RHODES" <TristanRhodes () weber edu>
Date: Wed, 27 Apr 2005 08:56:38 -0600
I am considering using Snort to monitor two uplinks on a Cisco 6500 into the core. This will be done using SPAN to mirror the traffic on both uplinks to single port. Assume that bandwidth is not a problem. These are equal-cost routes, so traffic will be load-balanced by OSPF. (I think this is load-balanced by flow, not per packet). Does anyone know what the effect this setup (load-balanced links) will have on the ability of Snort to do it's job? Tristan Rhodes ------------------------------------------------------- SF.Net email is sponsored by: Tell us your software development plans! Take this survey and enter to win a one-year sub to SourceForge.net Plus IDC's 2005 look-ahead and a copy of this survey Click here to start! http://www.idcswdc.com/cgi-bin/survey?id=105hix _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort on two load-balanced links (using SPAN on a Cisco 6500) Tristan RHODES (Apr 27)