Snort mailing list archives
Snort/Linux Dropping Packets
From: "snort user" <snortuser () hotmail com>
Date: Wed, 21 Apr 2004 22:33:05 +0000
Hi,Well Ive been playing with snort just a little more and not just using my pretty GUI. What I noticed though is that snort is actually dropping a significant amount of packets. So I actually made a little test system with some parts around here. I put a gigE card in 2 machines one for snort and one for the 'attacker' and I ran some traffic with tcpreplay. What I noticed is that when snort hits about 200 Mbits/s there is a significant packet loss.
I tried using the libpcap-mmap version but there was no real change. There must be a way around this becuase Ive heard a lot of people running snort on linux. Is there any way to increase the amount of traffic snort can handle?
--SU-- _________________________________________________________________Lose those love handles! MSN Fitness shows you two moves to slim your waist. http://fitness.msn.com/articles/feeds/article.aspx?dept=exercise&article=et_pv_030104_lovehandles
------------------------------------------------------- This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek For a limited time only, get FREE Ground shipping on all orders of $35 or more. Hurry up and shop folks, this offer expires April 30th! http://www.thinkgeek.com/freeshipping/?cpg=12297 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort/Linux Dropping Packets snort user (Apr 27)