Snort mailing list archives
Re: Wacky perfmonitor numbers
From: Gary Richardson <gary.richardson () gmail com>
Date: Tue, 24 May 2005 09:57:23 -0700
That's what I figured.. Any ideas why they aren't correct? On 5/24/05, Briggs, Bruce <Bruce.Briggs () suny edu> wrote:
I'm impressed. You managed to drop WAAAAY more than 100% of the packets!! These stats can not be correct. Bruce -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Gary Richardson Sent: Tuesday, May 24, 2005 11:52 AM To: snort-users () lists sourceforge net Subject: [Snort-users] Wacky perfmonitor numbers Hey guys, I'm currently testing out snort. My test box is a 1GHz P3 with 512MB of ram. I'm monitoring a 100mbit port. It averages 4.5mb/s but does peak up to the full 12mb/s. This is a very untuned box. It's not what I plan on running with in production, it's just for testing out the web interfaces and getting a handle on our network needs. I totally expect to get packet lose with this setup. That being said, I don't expect perfmonitor to dump out numbers like this: Snort Realtime Performance : Fri May 20 11:04:38 2005 -------------------------- Pkts Recv: 177339 Pkts Drop: 18446744073709550519 % Dropped: 10401966896006828.00% My perfmonitor directive looks like this: preprocessor perfmonitor: time 300 file /var/log/snort/snort.stats pktcnt 10000 console I'm running snort 2.3.3, built from the src rpm from snort.org. It's a RHEL4 box. Also, is there a replacement for perfstats.c? Thanks. ------------------------------------------------------- This SF.Net email is sponsored by Yahoo. Introducing Yahoo! Search Developer Network - Create apps using Yahoo! Search APIs Find out how you can build Yahoo! directly into your own Applications - visit http://developer.yahoo.net/?fr=fad-ysdn-ostg-q22005 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users
------------------------------------------------------- This SF.Net email is sponsored by Yahoo. Introducing Yahoo! Search Developer Network - Create apps using Yahoo! Search APIs Find out how you can build Yahoo! directly into your own Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Wacky perfmonitor numbers Gary Richardson (May 24)
- Re: Wacky perfmonitor numbers Jeremy Hewlett (May 24)
- Re: Wacky perfmonitor numbers Gary Richardson (May 25)
- <Possible follow-ups>
- RE: Wacky perfmonitor numbers Briggs, Bruce (May 24)
- Re: Wacky perfmonitor numbers Gary Richardson (May 24)
- Message not available
- Re: Wacky perfmonitor numbers Gary Richardson (May 24)
- Re: Wacky perfmonitor numbers Joel Esler (May 24)
- Re: Wacky perfmonitor numbers Gary Richardson (May 24)
- Re: Wacky perfmonitor numbers Gary Richardson (May 24)
- Re: Wacky perfmonitor numbers Jeremy Hewlett (May 24)