Re: Snort in a cluster

[Brian <bmc () snort org>]

On Fri, Jul 09, 2004 at 08:41:18AM -0300, Luis Claudio Rodrigues da Silveira wrote:
> Hi all,
>
> is it possible to setup a beowulf cluster running many snort sensors
> at once? Is there any advantage in terms of performance on packet
> processing??

Eric, are you listening?  This question needs to be added to the
drinking game.  Since it is fairly rare, but wacked in its own right,
I think a "full slam" is appropriate.

To answer your question, NO.  IDS is not something that beowulf
clustering is useful for.  Read up on beowulf clusters and you will
see that they are best suited for trivially parallelized tasks.

NIDS is not easily parallelized.

Brian


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users