Snort mailing list archives
Re: A question about multipleconfigs and network interfaces
From: Martin Holste <mcholste () gmail com>
Date: Sat, 12 Mar 2011 15:02:28 -0600
If you use standalone (c), then there is less packet filtering overhead on instances which are not concerned with a given packet. That said, there is more room for mistakes when traffic isn't on the interface you think it is. If you're dealing with traffic over a few hundred megabits per second, I would definitely do standalone. If you've got less, then I would do bond (b). On Sat, Mar 12, 2011 at 7:11 AM, carlopmart <carlopmart () gmail com> wrote:
Hi all, When multipleconfigs is used, which is the best option for configure network interfaces?? a) Make a bridge interface (br0) with all nics needed to sniff traffic on required networks. b) Make a bond interface (bond0) with all nics needed to sniff traffic on required networks. c) Use standalone interfaces. Many thanks. -- CL Martinez carlopmart {at} gmail {d0t} com ------------------------------------------------------------------------------ Colocation vs. Managed Hosting A question and answer guide to determining the best fit for your organization - today and in the future. http://p.sf.net/sfu/internap-sfd2d _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ Colocation vs. Managed Hosting A question and answer guide to determining the best fit for your organization - today and in the future. http://p.sf.net/sfu/internap-sfd2d _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- A question about multipleconfigs and network interfaces carlopmart (Mar 12)
- Re: A question about multipleconfigs and network interfaces Martin Holste (Mar 12)