Snort mailing list archives
Re: Acceptable packet loss?
From: Joel Esler <eslerj () gmail com>
Date: Mon, 23 May 2005 18:50:44 -0400
Being in a high-optempo environment such as I am. I judge 0% to be acceptable. With a max of about 3%. But I haven't had any packet loss in over a year. (On a box running a 1.6 GHZ with 256Ms of RAM, on a rather large circuit.. It has alot to do with rule tuning and output module as well..) On 5/23/05, Matt Kettler <mkettler () evi-inc com> wrote:
Byron Pezan wrote:What do most of you consider to acceptable packet loss? I am running snort 2.1 on some fairly low end hardware and have tuned the box using some suggestions from Mark Kettler in one of his earlier posts to the list (http://marc.theaimsgroup.com/?l=snort-users&m=105586643024094&w=2). I am seeing about 4% packet loss on this sensor during my (un-scientific) testing. Would you consider that acceptable or should I look into further tuning?My name is Matt, not Mark :) That aside, really what level of packet loss is acceptable depends a lot on what your security goals are. To a person operating a high-threat, high-security network, any packet loss is completely unacceptable, as it means an attack could be missed. A sophisticated attacker may try to intentionally load down the IDS with a bogus alarm that is likely to be ignored just fractions of a second before the real attack. If your goals with snort are just to increase your security awareness a bit, then some packet loss may be acceptable to you. So, I guess you could boil it down this way: Are you concerned with detecting sophisticated attackers who try to use noise to evade IDS detection. If so, you need 0% loss. If you aren't concerned with the evasive attacks, what percentage of ordinary attacks are you willing to accept not knowing about? Your packet loss rate should definitely be less than this number. As a rule-of-thumb I might suggest trying to keep your packet loss at less than half your accepted miss rate. I'll admit that "factor of one half" is largely a gut-instinct number and has no measured basis. However, it is definitely true that the impact of a packet loss can be much greater than missing one packet worth of data when you start considering that stream4 can get confused about the connection state, particularly if it misses a syn packet. Weighing that back and forth with how few packets are syn packets leads me to feel that somewhere between 3/4 and 1/4 would be about the right weighting factor. As this is a very inexact guess I certainly invite you to think about this yourself and come to your own conclusions. ------------------------------------------------------- This SF.Net email is sponsored by Oracle Space Sweepstakes Want to be the first software developer in space? Enter now for the Oracle Space Sweepstakes! http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- Joel Esler BASE Project Lead http://sourceforge.net/projects/secureideas ------------------------------------------------------- This SF.Net email is sponsored by Oracle Space Sweepstakes Want to be the first software developer in space? Enter now for the Oracle Space Sweepstakes! http://ads.osdn.com/?ad_idt12&alloc_id344&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Acceptable packet loss? Byron Pezan (May 23)
- Re: Acceptable packet loss? Matt Kettler (May 23)
- Re: Acceptable packet loss? Joel Esler (May 23)
- Re: Acceptable packet loss? byte_jump (May 23)
- <Possible follow-ups>
- RE: Acceptable packet loss? Biswas, Proneet (May 24)
- Re: Acceptable packet loss? Matt Kettler (May 23)