For multi-server situations, using Arista's Tap Aggregation (TapAgg) architecture is a popular solution for splitting up network packets after doing a optical fibre tap on the network connection:
The hosts would run software like Suricata, which is multi-threaded, and so can take advantage of many cores. (Until recently (3.0?) Snort was single-threaded.)
* https://www.arista.com/en/solutions/tap-aggregation-with-dan...
The hosts would run software like Suricata, which is multi-threaded, and so can take advantage of many cores. (Until recently (3.0?) Snort was single-threaded.)