recommended approach for multi-instance Snort

[ziggypiggy via Snort-users <snort-users () lists snort org>]

I have a reasonably capable Dell R740 with Intel XL710 2x40Gbps NIC to
do Snort performance testing on. Is there a general consensus on the
best approach (i.e. highest throughput) for doing multi-instance Snort
(v2.9.11.1)?

The options I see are: 

  - PF_RING
  - DPDK
  - something else?

I'm assuming using OVS and Snort VMs would have lower performance
because of the potential bottledneck of OVS and overhead of KVM.

Intel(R) Xeon(R) Gold 6138 CPU @ 2.00GHz
Thread(s) per core:    2
Core(s) per socket:    20
Socket(s):             2
Memory:  128GB

Thx,


_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette