Snort mailing list archives
Re: Pin snort single processor
From: Jason Wallace <jason.r.wallace () gmail com>
Date: Tue, 6 Apr 2010 11:53:36 -0400
OK so there is no affect on tracking frags, state, or anything else that might adversely affect detection. It is just a performance recommendation for folks using more than one instance of Snort? Thx, Wally On Tue, Apr 6, 2010 at 11:47 AM, JJ Cummings <cummingsj () gmail com> wrote:
Most typically for load distribution on a multi-core system.. So what I mean by this: you have two cores and a big network with loads of traffic, use a bpf and two snort instances (each pinned to a different core) to segment the monitoring of this large and noisy network to two (or more) snort instances and CPUs... JJC On Tue, Apr 6, 2010 at 9:39 AM, Jason Wallace <jason.r.wallace () gmail com> wrote:I remember seeing a conversation about pinning the snort process to a single CPU/core. Looking back I found the thread that talked about how to do this, but I could not find the conversation about _why_ this should be done. What is the actual undesired results of not pinning the process to a single CPU? Thx, Wally ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Pin snort single processor Jason Wallace (Apr 06)
- Re: Pin snort single processor JJ Cummings (Apr 06)
- Re: Pin snort single processor Jason Wallace (Apr 06)
- Re: Pin snort single processor Edward Bjarte Fjellskål (Apr 06)
- Re: Pin snort single processor Will Metcalf (Apr 07)
- Re: Pin snort single processor Jason Wallace (Apr 06)
- Re: Pin snort single processor JJ Cummings (Apr 06)