If your goal is to have maximum bandwidth/throughput on a single connection, you’ll get better performance with a CPU that has higher single core performance. While Sophos does run multiple instances of Snort on each CPU core, this is so it can run dedicated instances of Snort on each connection (i.e. better multi-connection performance). It looks like Snort 3.0 is still in the alpha stage so I’d imagine it’s going to be a while before we see a stable release.
↧