[Emerging-Sigs] OT - To restart or not to restart that is the question

evilghost@packetmail.net evilghost at packetmail.net
Mon Oct 18 20:35:40 EDT 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On 10/18/2010 06:54 PM, Joel Esler wrote:
> nor do I have 3 copies of Snort running, (as you apparently do for some odd reason <shrug>).  

I run 4 to 5; BPF, flow-pinned, and taskset to the appropriate core to
avoid cache-trashing.  Are you insinuating that more than once instance
is unwise?  You do understand your buddy Marty says that's what should
be done, correct?

http://www.linuxengarde.net/modules/index/list_archives.cgi?list=snort-devel&page=0011.html&month=2008-06

Quoted:

'Better "bang for the buck" has been seen with approaches like load
balancing and "flow pinning" across multiple Snort instances running on
multiple CPU cores.'

- -evilghost
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAEBAgAGBQJMvOfcAAoJENgimYXu6xOHWx4P/0NqDXhtwYfAc/BfnelnsiL+
OKpfbByxV8+PEi/FDtxvjzTlLrb6ln6E9/ndyhyFXGOy782ZRHFbxxzOEAHa4QHy
7sqbtbvy8yRKMwVzNkhU0W3Wr9StHtHu/W38voLcZ7BQ3J+f4jJWTSWhKkjxSTu1
xrwCb1he9UGeUFSpEpemGZeFPL0kPU4/bIkSKtaQdzS0XsI7PtaNvPFrj7CKp503
gLr7SDBUInMeHdw0PuoBHLaAzRfpq4nu3TQV9pqS4Pf10RBHf59Bh0KfONu3b9Fq
aiz2vO3AMSeSRDCrYjyqavifoHt7LZZi6k00ykdEBWLkdcD7J8O2Kv/I39Gr/qUw
j+9Bng7YkRixRCyExbiK3UkjfUZaJsPg4AFSqEU7P+trGhK7pZmKhDvCCkK09sfZ
95Y/d6IES4HW2EDRobp4CpucjHAnRRJ8dc/0+zFYkYSXgQv5XHQSPCuHCNSGas3N
bxNv3NSUChVhv/jpff4rx4pqjn0vBTPgzvJcdEZJOfDFM6vfYKPWSLDy1Q04jrs7
rpRF8EYvW+ChKgL0dsbGUHMj7NVamSuheF0GKIMxPR5uUGKnSMUbzgbkhs3sU7kF
Htiqp9ICFIVRMBL1ukkSjW+FTBatfTh01KofVtYTOd3fPc3UAdTkIvOwOB8aQ9RY
iAGOEHCCvHEuw0x+BJKi
=yN0n
-----END PGP SIGNATURE-----


More information about the Emerging-sigs mailing list