Performance issues with SNORT

["Vikalp Nagori" <vikalp.nagori () vinciti com>]

We are trying to benchmark Snort-1.8.3 running on HP P3 933MHZ , 512Mb RAM on linux.

We ran tcpreplay on defcon dump and realized snort dropping 33% packets with default preprocessors and rules.

We disabled all the preprocessors and rules still snort is dropping 20% packets.

 would like to have inputs -

1. Are we in right direction? what is the best way of benchmarking snort?
2. What is the configuration of hardware expected by snort to give its best performance on 100Mbps network?
3. What is the optimum settings (ruleset, preprocessors and output plugin) to get efficient performance from snort 
placed before firewall on 100Mbps network?

Any help ???


Vikalp Nagori