Is this normal behavior for Snort? (see attachment)
You can see when I installed Snort. Before there were no interrupts.
The only other package I have installed is pfBlockerNG-Dev
bmeeks last edited by
Snort puts monitored interfaces into promiscuous mode. This could, I suppose, generate a few more NIC interrupts as the card will be processing all packets instead of just packets sent to its MAC address.