Snort instances and cores information

[vip2442]

Hi there,

I have snort + pf_ring configured on centos 6. Now I want to show that
if I run 2 instance of snort each instance will use 1 core of the 2
cores cpu, how can I test that ?

I followed http://www.metaflows.com/technology/pf-ring/
and I run snort by this command:

snort -c snort.conf -i eth0 --daq-dir /usr/local/lib/daq --daq pfring
--daq-var clusterid=10 --daq-mode inline -Q


Thanks

[li...@metaflows.com]

Just run the command twice with the same exact arguments and they will slip the traffic. The pfring kernel module will automatically detect how many processes are running and split the traffic accordingly.
--
Sent from my Android phone with K-9 Mail. Please excuse my brevity.

[li...@metaflows.com]

Also, If you only use one interface (passive mode) remove the daq-var inline -Q arguments

--
Sent from my Android phone with K-9 Mail. Please excuse my brevity.

[li...@metaflows.com]

I ment remove --daq-mode inline -Q

--
Sent from my Android phone with K-9 Mail. Please excuse my brevity.