Task #3301
Updated by Victor Julien over 4 years ago
Failover support would make sure that if there are multiple Suricata instances and one of those disappears, the other Suricata IPS instances would 'do the right thing'. What doing the right thing is is an open question. Some of the ideas:
* sync flow table so that flow tracking would stay active
* sync 'drop settings' per flow/host/etc
* sync thresholding
* datasets?
I think one of the first things that needs to be done is analyze how Suricata currently works in a IPS failover case.