I have seen snort sFlow integrations done a few times times with varying
degrees of success. Definitely worth exploring as it doesn't cost ya much
other than your time. Problems with sample rates and TCP state are the
biggest barriers for serious content inspection.

1 in 128 is about the lowest mo...

[ more ]