Snort interrupts
-
Is this normal behavior for Snort? (see attachment)
You can see when I installed Snort. Before there were no interrupts.The only other package I have installed is pfBlockerNG-Dev
Simon
-
Snort puts monitored interfaces into promiscuous mode. This could, I suppose, generate a few more NIC interrupts as the card will be processing all packets instead of just packets sent to its MAC address.
Bill