Re: Multi-process Snort

[Peter Bates <peter.bates () ucl ac uk>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi all

On 17/08/2012 12:12, Pratik Narang wrote:
> Thanks to Joel, Robert and others for the help. When we talk of a
> multi-process Snort, we are talking of multiple instances of Snort
> over different cores, right? How is the Pre-processor based engine
> and the detection engine then balanced between the different
> instances of Snort? Is it like one instance takes care of 10K
> rules, the other of 12K rules and something like that?

There may be other ways of achieving the goal - but the PF_RING
example works by spreading the traffic across the instances - each
instance is the same, with all rules loaded and the same configuration
(apart of course from where it alerts to).

Other than Martin Holste's blog as previously linked, also see:
http://www.metaflows.com/technology/pf-ring/
http://www.metaflows.com/technology/10-gbps-pf_ring-2/

- -- 
Peter Bates
Senior Computer Security Officer    Phone: +44(0)2076792049
Information Services Division       Internal Ext: 32049
University College London
London WC1E 6BT
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJQLi5EAAoJELhVoVpEMS6RZj4IAIqYksiP/ZQ5YaTRYZPY3Q8X
uuHychfMdfkdBvsBjSmwiWLHF6XGi/ywNzXrxBZ7NDsAIsycl379EQkAYpGpOioJ
sfNbfWIrl90RoKiFEjjCr/Z5AeOs8AfjZqzyqKyJ/Q90pCfji2awAN5NOBwiAY6E
ZB4MXbUctwFc4v4tLliBE7Kya66wCgB4asC02DC45D+lpGSJzeiMPY6q/JYYj+lJ
W3BJxKC8/Nm96v1tQdFukV3wuwbLdaU6LD9sbvSvY2xjt9OdVuE0bR1GgGxC24F0
ARXs5x5mDALakoVNxRDHgvaCM65+uVq77OdPHBXSXhjM5KmTj/jbd3+7Y4kHMOI=
=32B0
-----END PGP SIGNATURE-----


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!