Re: Quick questions about recieved packets

[Richard Bejtlich <taosecurity () gmail com>]

Joseph Nicholson wrote:

> I see that snort dropped 179457 packets because it couldn't process them.
> Snort received 186246 packets
> Analyzed: 6789(3.645%)
> Dropped: 179457(96.355%)
> My gut instinct is telling me that it dropped 179457 packets because it
> felt there was no threat from them and that the 6789 it analyzed looked
> suspicious.

Hi Joseph,

You have a serious problem with your Snort deployment.  The packets
Snort dropped were never inspected, period.

Can you describe your configuration?  Are you sending Snort alerts
directly to a database, without Barnyard?  Are you running any odd
rules?

Sincerely,

Richard
http://www.taosecurity.com


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.
Get Certified Today * Register for a JBoss Training Course
Free Certification Exam for All Training Attendees Through End of 2005
Visit http://www.jboss.com/services/certification for more information
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users