Using Snort in Virtual Machines with PF_RING

[Ayodele Okeowo <aymacro () gmail com>]

Gents & Ladies,

I've been reading a lot on PF_RING integration into Snort, and I do have a
question which I think community may be able to help.

I have a HP DL380 Dual Quad Core which has 2 virtual machines running with
4 Cores each. These VMs have 3 interfaces where 2 are being used for
sniffing and 1 for mngt. Now my question is, should I place PF_RING on the
Host machine or should it be placed on each Snort VM?

Since PF_RING load balances traffic from multiple Snort instances on a
single interface, it becomes a little confusing on how to proceed. If this
works out, I would be glad to create an article to help folks out there.

Thanks in advance for your responses.

Ayo

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!