Snort mailing list archives
Re: Performance questions
From: John Sage <jsage () finchhaven com>
Date: Fri, 18 Jan 2002 18:22:39 -0800
hmm..Linux-type, ab-so-lute-ly, but I have no experience with traffic of that volume: my little petri dish is a Pentium 150 behind a 56k modem...
(Hey! somebody's gotta do dialup!) - John -- The web page you seek cannot be found here: countless others await Erek Adams wrote:
On Fri, 18 Jan 2002, Lucas de Carvalho Ferreira - BMS wrote:I am trying to monitor a high traffic 100Mbs switch port with snort on a 433 MHz Celeron machine running Red Hat 7.2 but snort is dropping about 10% of the packets, even if the CPU load is at an average of 70% (seen with top). Is there any configuration tips for snort or for the Linux kernel to get better performance? Could it be an I/O performance problem?Ummm... Lucas, that's a bit of a small box for that kind of load. Have a look at this snipped email from Marty to the snort-users list from earlier last year. http://www.theadamsfamily.net/~erek/snort/perf.txt If you want to see the whole email, it's archived at: http://marc.theaimsgroup.com/?l=snort-users&m=100208652925991&w=2 For Linux specific tips, do some archive searching. I don't run Linux so I've not any useful info on it. Check the archives for posts from Abe Getchell, Phil Wood, and John Sage. Off the top of my head, those guys leap to mind as Linux-type folks. :) Good luck! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Performance questions Lucas de Carvalho Ferreira - BMS (Jan 18)
- Re: Performance questions Erek Adams (Jan 18)
- Re: Performance questions John Sage (Jan 18)
- Re: Performance questions Chris Green (Jan 18)
- Re: Performance questions Saad Kadhi (Jan 18)
- RE: Performance questions Abe L. Getchell (Jan 18)
- Re: Performance questions Olaf Schreck (Jan 19)
- <Possible follow-ups>
- RE: Performance questions Lucas de Carvalho Ferreira - BMS (Jan 21)
- RE: Performance questions Fernando Miguelez Palomo (Jan 22)
- RE: Performance questions Petriz, Pablo (Feb 01)
- RE: RE: Performance questions Abe L. Getchell (Feb 03)
- Re: Performance questions Erek Adams (Jan 18)