Snort interrupts

  • Is this normal behavior for Snort? (see attachment)
    You can see when I installed Snort. Before there were no interrupts.

    The only other package I have installed is pfBlockerNG-Dev


  • Snort puts monitored interfaces into promiscuous mode.  This could, I suppose, generate a few more NIC interrupts as the card will be processing all packets instead of just packets sent to its MAC address.


Log in to reply