Snort mailing list archives
Re: (no subject)
From: Peter Bates <peter.bates () ucl ac uk>
Date: Thu, 21 Jun 2012 19:14:30 +0100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all On 21/06/2012 17:49, Kungu Panda wrote:
Not sure why anyone would need multiple instances of snort to achieve the same result. In fact, it would seem to be wildly inefficient to run multiple instances of snort to inspect the same traffic. Of course, you may have systems and cpu's to burn.
Oh, I'd agree 100% - but I have more than a Gig of traffic to inspect on a 10G link and I'm needing a bit more horsepower. I guess I should have said I'm mostly following: http://www.metaflows.com/technology/10-gbps-pf_ring-2/ The NIC has 8 RX queues which PF_RING hashes to 8 CPU cores - - as a result you have to run x instances of Snort. - -- Peter Bates Senior Computer Security Officer Phone: +44(0)2076792049 Information Services Division Internal Ext: 32049 University College London London WC1E 6BT -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJP42SGAAoJELhVoVpEMS6R0qgH+wRBpmwsIunU+/P7WgPGHYJz 6Sj1b8+2PP5Z4lcBd6bdi1x03KIEad/YSKJdJhGDouzG3npcpFT4qub8lV9AwrSi 8kAMEJbcTqoICxuY0AdpZRNvl6ijev3WagAbRgNmB7G8b/QlOCPIwxhv+dwE/JPD J8dGoOrmiR+SZvFRY/upZGweW8evP+nZZyHp1JYSDEgTx1FXUopW18vMaCO4TrfZ qiKr9BiSQKhsumYfCWLhd3pQwuCmGWqSOr0p9AJE7toa5COuwMh5WzuexCYaZBzW mwLSFyrA4BqSKBVv7WZklzvwpyCvSvSJFRqOt+ayblm+5tqdYCBe1a04vMl860s= =5opq -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Re: Diameter, (continued)
- Re: Diameter Joshua Kinard (Apr 10)
- Re: Diameter asiaimbiss (Apr 11)
- Re: Diameter Joshua Kinard (Apr 11)
- Re: Diameter asiaimbiss (Apr 11)
- (no subject) Indrajeet Gupta (Apr 11)
- Re: (no subject) CleBeer (Apr 11)
- (no subject) Simon Blixt (Apr 21)
- Re: problem with Snort-rules not matching [SOLVED] Simon Blixt (Apr 25)
- (no subject) afessa akahc (May 14)
- (no subject) Kungu Panda (Jun 21)
- Re: (no subject) Naresh Narang (Jun 21)
- Re: (no subject) Peter Bates (Jun 21)
- (no subject) Deepika p (Jun 22)
- Re: (no subject) Charles Pigeon (Jun 23)
- Re: Diameter Joshua Kinard (Apr 10)