Snort newbie: how to enable multi processes Snort in pfSense?
abcnew last edited by abcnew
I used Snort in security onion before. In security onion, there is a setting to put the number of CPU cores, then Snort fork the same number of processes as CPU cores to monitor a same interface.
I do know each Snort process can handle around 200mbps data throughput. And I also know that PF_Ring is a linux thing. So, how to monitor more than 200mbps throughput on a same interface on Snort of pfSense? I haven't found the configuration in the Snort GUI of pfSense or the official manual of netgate.
Any opinions will be welcomed.
bmeeks last edited by
This is not supported within the GUI on pfSense.
abcnew last edited by
Thank you, Bill.