I have just set up an IDS server, it is a linux server running snort and we have it set as our default gateway, we used to have our squid cache server (also linux) set as our default gateway. The cache server only ever used about 25% of its cpu when it was handling all the traffic as the gateway but now that I have made the IDS server the gateway and am redirecting all port 80 traffic to the cache server the cache server is using 100% of the cpu all the time.
On the ids I am using iptables to redirect the traffic here are the rules I have in it:
Code:
iptables -t nat -A PREROUTING -s 63.166.92.0/23 -p tcp --dport 80 -j
DNAT --to 63.174.233.5:3128
iptables -t nat -A POSTROUTING -s 63.166.92.0/23 -d 63.174.233.5 -j
SNAT --to 63.174.233.2
63.166.92.0/23 is our dialins I am trying to redirect to the cache
63.174.233.5 is our cache server
63.174.233.2 is our IDS machine and gateway
The cache machine is only handling about a third of the load it was doing but now it is maxing on cpu, it has about 400 - 500 concurent connections, the only difference is instead of coming from about 400 clients it is all coming from the ip of the IDS server. The IDS server is only using about 2% of its cpu.
Does anyone have any ideas of what this could be?
