[Snort-users] Snort on two load-balanced links (using SPAN on a Cisco 6500)

I am considering using Snort to monitor two uplinks on a Cisco 6500 into
the core. This will be done using SPAN to mirror the traffic on both
uplinks to single port. Assume that bandwidth is not a problem.

These are equal-cost routes, so traffic will be load-balanced by OSPF.
(I think this is load-balanced by flow, not per packet).

Does anyone know what the effect this setup (load-balanced links) will
have on the ability of Snort to do it's job?

Tristan Rhodes


-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start! http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users