Snort mailing list archives

Snort Packet Processing issue


From: HASSAN Qadeer via Snort-users <snort-users () lists snort org>
Date: Wed, 24 Apr 2019 10:03:11 +0000 (UTC)

Hello Team,
Hope you are doing great!
I'm using snort version 2.9.12 on Ubuntu 16.04 on vmware with four cores and a single network interface card. I'm 
trying to optimize the performance of network monitoring by running multiple snort instances on different cores.
To generate the traffic, I am using Colasoft packet player in burst mode with a pcap file having 10 million packets.
To test the scenario, I am transmitting 1 million packets to snort and all the four instances of snort are monitoring a 
single interface. The issue is that when i transmit 1 million packets, each core separately process 1 million packets 
resulting in total processing of 4 million packets.
Can you please help me in distributing / load balancing network traffic among multiple cores for snort processing.
Thanks and regards.Hassan QadeerĀ 
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Current thread: