Re: internal load balancing for multi-thread processing (Snort3)

[Russ via Snort-users <snort-users () lists snort org>]

On 8/16/18 9:36 AM, Carter Waxman (cwaxman) via Snort-users wrote:
> Yes, we are still working on internal load-balancing support. However, it is still possible to run with multiple 
> threads. In short, you probably want to use AFPacket with fanout.
>
> This thread has a good explanation
>
> http://seclists.org/snort/2016/q3/383
Hint:  take care to place the fanout arg before the interface on the 
command line to ensure that it applies to all interfaces (as done in the 
first example) or use the Lua config instead.
> On 8/16/18, 8:31 AM, "Snort-users on behalf of ziggypiggy via Snort-users" <snort-users-bounces () lists snort org on 
> behalf of snort-users () lists snort org> wrote:
>
>      Looking into Snort3 with multiple CPUs I found a thread from 2015 which says:
>      
>        "Snort++ currently requires external load balancing if you want to use multiple
>        packet threads with live traffic. In that case you can specify
>        -i "eth0 eth1 eth2" or whatever. Likewise with pcaps. We are planning to add support
>        for internal load balancing in a future version."
>      
>        http://seclists.org/snort/2015/q2/91
>      
>      Is it still the case that some form of external load balancing is required for doing  multi-threaded Snort?
>      
>      Thx,
>      
>       
>      _______________________________________________
>      Snort-users mailing list
>      Snort-users () lists snort org
>      Go to this URL to change user options or unsubscribe:
>      https://lists.snort.org/mailman/listinfo/snort-users
>      
>      	To unsubscribe, send an email to:
>         snort-users-leave () lists snort org
>      
>      Please visit http://blog.snort.org to stay current on all the latest Snort news!
>      
>      Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
>      
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
>         To unsubscribe, send an email to:
>         snort-users-leave () lists snort org
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette