I may be wrong, but I think that each sniffing application creates a new packet
socket, and this means that if you have, say, snort and tcpdump both sniffing
the same traffic, each packet is queued into two socket queues (and gets
copied. An additional copy is made to send the packet into the normal IP
processing queue unless it is disabled for that interface). Phil wood's pcap
then kicks in to avoid that each of these packets is copied again into user
space (because the socket queue is memory mapped into user space and can be
accessed directly).
Whatever the details are, since when an application gets access to the memory
of a packet it can modify them (snort does that too, rpc_decode i think is an
example), it would be unsafe not to make a different copy for each application.
Sharing access to the sniffed packets would require a rather large amount of
tampering, either in the kernel or in the applications involved.
So having multiple sniffing applications will slow down snort.. how big a
slowdown i guess you won't know until you try it out.
Paolo
Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.
====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
MailAdmin@tilab.com. Thank you
====================================================================
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
