Hello everyone
I have a small problem, I have a router mikrotik CCR1016-12G with RouterOS version 6.43.12, which is at the beginning of my network and does, among other things, the firewall. In practice there is a router for internet access connected to a switch with two mirrored ports, one is connected to 1016 and the other to a server where SNORT (Network Intrusion Detection & Prevention System) is installed. SNORT analyzes the traffic and through a script accesses the ssh to 1016 and writes the ip to block in the firewall blacklist. This system works well for about a year and a half, every two weeks I had to restart the 1016 because snort was logged in to 1016 but no longer wrote any ip, now I have to restart it twice a day to keep writing. In my network there are about 1000 devices with public IP addresses and snort on average writes about 8000 ip blacklisted per day.
Could it be 1016 that is too weak?
Are there any more optimal methods for connecting SNORT to RouterOS?
Thanks in advance for your answers.