how snort and ip forwarding fit together

["Dharmin Parikh" <dharminparikh () hotmail com>]

I am using snort on lrp oxygen & Mandrake(set up as router too).
Snort is sniffing on eth1 & I am flooding traffic from a test system
into eth0. I believe that snort picks up the ip packets from the
memory after the ip forwarding function in the kernel puts them
in the memory( eth1 outbound queue).

Does snort work in a polling fashion or the kernel signals the
snort process each time it puts the packet in the memory ?

Or I've got it totally wrong !!:)

any suggestions !

-Dharmin.


_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users