Re: 2.1.3rc1 Performance

[Dirk Geschke <Dirk_Geschke () genua de>]

Hi Gary,

> Yesterday I replaced my 2.1.1RC1 build with 2.1.3RC1.  Today I checked the 
> perfmon stats and nearly fell off my chair.  They are reporting that snort 
> is dropping on average about 15% of traffic.  With 2.1.1RC1 perfmon has 
> always reported 0% pkts dropped and I believed it.  Now I am seeing that 
> there are times when snort is dropping as much as 89%, and that is at 
> times with only 0.9mbps throughput and using 11% of the cpu.  Some other 
> times i am seeing drop rates of 12% with 5.1mbps throughput while using 
> 77% of the cpu.

did you use the same rules on both versions? There are a lot of changes
between these two versions especially an increase in the use of pcre...

And did you also use the same libpcap?

Best regards

Dirk



-------------------------------------------------------
This SF.Net email is sponsored by: SourceForge.net Broadband
Sign-up now for SourceForge Broadband and get the fastest
6.0/768 connection for only $19.95/mo for the first 3 months!
http://ads.osdn.com/?ad_id=2562&alloc_id=6184&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users