Snort mailing list archives
Dropped packets with multiple nics
From: "Adam Cavaliere" <airedale () airedalez net>
Date: Tue, 21 Dec 2004 17:04:28 -0600 (CST)
I am just setting up Snort in an environment with ~500 computers. I am monitoring 5 servers and our WAN port. 2 of the servers only have one NIC installed. 1 Server has 3 NICs installed 2 Servers have 2 NICs installed If I monitor only one port on each machine Snort does not drop any packets. If I monitor more than one NIC on the servers that have multiple NICs, I seem to drop a huge amount of packets (at least 30%). The switches we are using are HP Procurve 4000's. When I add the multiple NICs to monitor I get a warning that broadcast messages can be duplicated on the monitoring port. It only happens when I add the NICs that are on the same machine to the monitoring list. If I add each server but only one NIC from each server I do not run into the waring message. Because of limited funds and other issues we are currently doing routing with the servers and it is not hardware based routing. The command line that I am using is: snort -v Any ideas as to why this might be happening? Hopefully I have provided enough info! Thanks, Adam Cavaliere ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Dropped packets with multiple nics Adam Cavaliere (Dec 25)