Snort on two load-balanced links (using SPAN on a Cisco 6500)

["Tristan RHODES" <TristanRhodes () weber edu>]

I am considering using Snort to monitor two uplinks on a Cisco 6500 into
the core.  This will be done using SPAN to mirror the traffic on both
uplinks to single port.  Assume that bandwidth is not a problem.

These are equal-cost routes, so traffic will be load-balanced by OSPF. 
(I think this is load-balanced by flow, not per packet).

Does anyone know what the effect this setup (load-balanced links) will
have on the ability of Snort to do it's job?

Tristan Rhodes


-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users