Snort mailing list archives
Re: Preproc tuning
From: Joel Esler <eslerj () gmail com>
Date: Fri, 17 Jun 2005 14:21:57 -0400
I know what it does. What I am saying is, if you specify them in the .conf file, as opposed to letting the compiled code do it, is it faster? In my tests it's showing significant CPU performance increase.. J On 6/17/05, snort user <snort.user () gmail com> wrote:
Those are the default ports for which state tracking/reassembly is done if you dont specify anything in the snort.conf # ports [list] - use the space separated list of ports in [list], "all" # will turn on reassembly for all ports, "default" will turn # on reassembly for ports 21, 23, 25, 53, 80, 143, 110, 111 # and 513 On 6/17/05, Joel Esler <eslerj () gmail com> wrote:Has anyone else noticed a significant performance increase by specifying the ports for stream4? If I look at the code for stream 4, take the ports that are in there. and specify them via the snort.conf ports: < 21 23 25 53 42 80 110 111 143 513 >....etc.. It is SO much faster and doesn't consume as much CPU resources... anyone? ------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&opclick _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?listsnort-users
------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Preproc tuning Joel Esler (Jun 17)
- Re: Preproc tuning snort user (Jun 17)
- Re: Preproc tuning Joel Esler (Jun 17)
- Re: Preproc tuning snort user (Jun 17)
- Re: Preproc tuning Joel Esler (Jun 17)
- Re: Preproc tuning Mohamed Eldesoky (Jun 19)
- Re: Preproc tuning Joel Esler (Jun 17)
- Re: Preproc tuning snort user (Jun 17)