Snort mailing list archives

Re: Dropping packets why?


From: Michael Sierchio <kudzu () tenebras com>
Date: Mon, 27 Oct 2003 12:50:29 -0800

O'Flynn, Derek wrote:
I have a 15mb pipe to the Internet, this is reports from tcpdump.

Dual p133 256mb I drop 50% packets.

Quad ppro200 1gb I drop about 20%.

Both were running FreeBSD 5.1 with custom SMP kernels and 3com905.

a 133MHz Elan (486) w/direct write to mfs (ram disk) and rotating
using tcpdump -c to NFS-mounted media drops no packets at twice
T1 speed.  That's observed performance, I haven't seen data rates
yet where it starts dropping packets.  One bottleneck is
in the Berkeley Packet Filter (copying buffers to kernel and then
to user space) and another the filesystem (softupdates or async
might help -- I use the latter on the mfs, figuring it's the battery
that provides integrity ;-)

With Phil Wood's buffer tweak, there's no reason a 200MHz PPro
should drop any packets (unless you're doing dns lookups, of course)
at your 1/3 DS3 rate.

--

"Well," Brahma said, "even after ten thousand explanations, a fool is no
 wiser, but an intelligent man requires only two thousand five hundred."
                - The Mahabharata



-------------------------------------------------------
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is doing for the Open
Source Community?  Make a contribution, and help us add new
features and functionality. Click here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: