Snort mailing list archives
How To Measure Promiscuous Mode ...
From: John Crain <port123tcp () yahoo com>
Date: Thu, 24 Jul 2003 05:24:49 -0700 (PDT)
I read that placing an interface in promiscuous mode increases system utilization, but I didn't find any specifics. Does anyone have any suggestions on how to measure the impact on a system by placing an interface in promiscuous mode? Q1: Would the impact on the system be dependent on the number of packets the system had to process? Q2: To take accurate measurements, would you agree that a packet generator would be necessary for testing? Q3: If yes to Q2, is it possible to build a packet generator to spit out the exact same type and number of packets for repeated testing? Q4: If a sensor interface with no IP address is attached to a SPAN port, does the sensor interface need to be in promiscuous mode? (I don't believe it does since all packets on the switch/router are being shot at the sensor and the sensor has no IP address to discern.) Q5: If a sensor interface with an IP address is attached to a SPAN port and the interface is not in promiscuous mode, will the sensor interface be able to "see" all packets from the SPAN port? Thanks. -John --------------------------------- Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo.
Current thread:
- How To Measure Promiscuous Mode ... John Crain (Jul 24)
- Re: How To Measure Promiscuous Mode ... Demetri Mouratis (Jul 24)