Re: Snort problems with low processor? (Agazzini Maurizio)

["Hever C. Rocha - N.O.C" <hever () itcbrasil com br>]

> Message: 9
> Date: Tue, 19 Mar 2002 11:59:06 +0100
> From: Agazzini Maurizio <maurizio () mediaservice net>
> To:  snort-users () lists sourceforge net
> Subject: [Snort-users] Snort problems with low processor?

> Hello ml,
> I got a problem with snort, I'm running on a 486 dx2 66Mhz OpenBSD 2.9 
> on ADSL, with snort 1.8.3 (it's the same with the 1.9 devel), some times 
> (I haven't undestand when) snort go to high processor utilisation and 
> will not decrase again... someone know why or a possible cause? I did 
> some test, as with full bandwith in download, (640Kb/s) but no result... 
> only sometime it did that...

> #ps aux
> USER       PID %CPU %MEM   VSZ   RSS TT   STAT STARTED       TIME COMMAND
> root     25149 97.8  7.1  7992  2304 p0- R      8:26PM  315:22.18 
> /usr/local/bin/snort -c /etc/snort/snort.conf -N


> Greatings

> Agazzini Maurizio

Hi Sir!

Read  this message...

Bugs item #527353, was opened at 2002-03-08 11:18
You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=103357&aid=527353&group_id=
3357

Category: None
Group: None
> Status: Closed
Resolution: Invalid
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: Snort 70%/80% CPU Usage on NT4.0

Initial Comment:
Hi Everyone!

I'm testing Snort 1.8.3 (MySQL Bynary) with the Windows
NT 4.0 (Service Pack 6a and hofix's)and Mysql (for the
logs)

When i'm send attacks for the test machine, like
IISDOS, the snort process increase the
use of the cpu computer (70% /80 %).
My network is a 10/100 Mbits, with the two computers
(the client and the snort machine) in the same segment.

My Hardware is:
Server (Where Snort is running)

PC Computer 
CPU Pentium 233 Mhz
64 MB RAM
IDE Hard Disk 3.2

Is N O R M A L ????????????????

Best Regards from Brasil

Hever Costa Rocha
N.O.C
55 (73) 234-3029
55 (73) 9133-0107
email: hever () itcbrasil com br
www.itcbrasil.com.br


----------------------------------------------------------------------

Comment By: Chris Green (chrisgreen)
Date: 2002-03-21 23:27

Message:
Logged In: YES 
user_id=429629

Yes, Snort is CPU dependent.

----------------------------------------------------------------------

You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=103357&aid=527353&group_id=
3357

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users