# Offloading the Snort work to another device

**URL:** <https://forum.openwrt.org/t/offloading-the-snort-work-to-another-device/112010>\
**Category:** Talk about Documentation\
**Created:** [November 15, 2021, 3:27pm UTC](https://forum.openwrt.org/t/offloading-the-snort-work-to-another-device/112010 "2021-11-15T15:27:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DAT4](https://forum.openwrt.org/user_avatar/forum.openwrt.org/dat4/32/43798_2.png) [@DAT4](https://forum.openwrt.org/u/DAT4)\
**Post date:** [November 15, 2021, 3:27pm UTC](https://forum.openwrt.org/t/offloading-the-snort-work-to-another-device/112010/1 "2021-11-15T15:27:29Z")

</div>

I have a router with about 500mb ram, I want to run Snort NIDS on the network, however [the wiki for SNORT on Openwrt](https://openwrt.org/docs/guide-user/services/snort?s%5B%5D=snort) states

> SNORT takes an absurd amount of memory and processing power with rules, BEWARE. Some people choose to offload the work to another device!!!

When I search how to do this on OpenWRT it says that version 2019 should have a port mirroring feature built in to the system under `Network -> Switch`

Before version 2019 port mirroring should be acheived by installing an iptables extension.

The only problem is that on version 2021 of OpenWRT the `Network -> Switch` does not exist, and I cannot find anything in the Lucy about mirroring, and I am unsure if I should just install the old extension that was used before 2019.

---

<div class="post-metadata">

**Author:** ![sml156](https://forum.openwrt.org/user_avatar/forum.openwrt.org/sml156/32/1620_2.png) [@sml156](https://forum.openwrt.org/u/sml156)\
**Post date:** [November 16, 2021, 4:41am UTC](https://forum.openwrt.org/t/offloading-the-snort-work-to-another-device/112010/2 "2021-11-16T04:41:30Z")

</div>

When they say offloading they mean get a dedicated device like a computer or virtual machine with two network adapters and run snort on that not openwrt