Re: Smoe questions about Snort & ACID !

[Joel Esler <eslerj () gmail com>]

You should also switch to BASE instead of ACID.  It's much faster.

http://www.sourceforge.net/projects/secureideas

Joel

On May 17, 2005, at 1:05 AM, James Riden wrote:

> mahboobeh soleimani <mah_soleimani () yahoo com> writes:
>
>
> >     1. In a worm situation that all of our bandwidth is used with
> >     attack , how does Snort react and it means ,does libpcap capture
> >     all of packets in our network or just some of the packets and
> >     does Snort process every packet which it receives?
>
> >     2. analyzing all of the packets in a worm situation how much can
> >     increase the Snort's CPU usage?
>
> On the hardware you give, snort should cope just fine, even with a
> full 10mbit/s pipe. I would expect it to cope with 100mbit/s + with
> the default ruleset.
>
> cheers,
>  Jamie
> --
> James Riden / j.riden () massey ac nz / Systems Security Engineer
> Information Technology Services, Massey University, NZ.
> GPG public key available at: http://www.massey.ac.nz/~jriden/
>
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_idt12&alloc_id344&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


Joel Esler
Owner, BlackTie Defense


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_idt12&alloc_id344&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users