Re: Snort in a cluster

[Michael Stone <mstone+snort () mathom us>]

On Fri, Jul 09, 2004 at 02:01:44PM +0100, you wrote:
> If you need more power for snort than a single CPU can provide, you 
> probably want to be looking at having multiple sensors and a IDS 
> load-balancing solution (e.g. Radware or Top Layer).

Or you can adjust the pcap filter so snort sees less traffic. I've had
good success running multiple snorts on one system where each sees part
of the traffic and together they can keep up with a faster link than a
single process trying to watch everything.

Mike Stone


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users