Hi, I'm running Snort on all my servers and have noticed it's consuming vast amounts of memory. Not all machines have lots of memory in either so it's sucking the resources a fair amount. My questions are: 1. Am I right in thinking, if I run Snort on just ONE server, telling it the IP range to listen on and using it's promisc mode, I can monitor everything? Rather than having Snort on each machine, listening on it's IP address. 2. If the above is not possible, how can I give back some memory from Snort (config. options I can turn off etc.) Thanks and regards, David. -- .''`. David Ramsden <david@hexstream.eu.org> : :' : http://portal.hexstream.eu.org/ `. `'` PGP key ID: 507B379B on wwwkeys.pgp.net `- Debian - when you have better things to do than to fix a system.
Attachment:
pgp239nHwVhgx.pgp
Description: PGP signature