Snort mailing list archives
Re: snort packet loss rate
From: Matt Kettler <mkettler () evi-inc com>
Date: Wed, 26 Apr 2006 11:51:32 -0400
Jin Fang wrote:
How much bandwidth is on that adapter? Is it really a gigabit connection, or is it feeding a lower-speed line? Is the card on a PCI bus, or something faster such as PCI-X or PCI-E?It is having gigabit throughput and card is on a PCI-X.
Ok, what kind of CPU are you running? You mentioned you have lots of ram, which doesn't hurt, but pure packet-pick-up rate when using simple tcpdump is largely going to be limited by one of 6 things: 1) the packet size mix. Full-gigabit is hard to catch all of, and full-gigabit with mostly small packets is even harder. What kind of data are you monitoring? Normal TCP transfers, or a gigabit of tiny packets? 2) The design of the NIC. In this area you should be OK. the NC7781 is based on a BCM570x type chip. While I dislike Broadcom for their secretive nature regarding datasheets, their hardware is at least reasonably well designed. 3) the NIC driver in the OS.. again, you should be fine here, but you might want to reasarch this avenue. There have been some reports of packet drops with the FreeBSD bge driver: http://unix.derkeiler.com/Mailing-Lists/FreeBSD/hackers/2004-05/0211.html If you have any other gig nics laying around using a different chip/driver, you could test one of those. If the packet-drops go away, it's likely a driver issue. If not, it's likely something else. 4) the scheduling and design of the OS. FreeBSD does well here and shouldn't be a problem. If you were running this on older families of windows you might have a big problem. 5) CPU speed. Obviously, if the CPU isn't reasonably fast you can't keep up with a gig stream. 6) the design of your PCAP library. ring buffered vs not can make a big difference, but you still should be fine on FreeBSD regardless of the design. You should at least be doing better than 50%, unless your CPU is slow. ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort packet loss rate Jin Fang (Apr 25)
- Re: snort packet loss rate Matt Kettler (Apr 25)
- Re: snort packet loss rate Jin Fang (Apr 25)
- Re: snort packet loss rate Matt Kettler (Apr 25)
- Re: snort packet loss rate Jin Fang (Apr 26)
- Re: snort packet loss rate Matt Kettler (Apr 26)
- Re: snort packet loss rate Gulfie (Apr 26)
- Re: snort packet loss rate Jin Fang (Apr 25)
- Re: snort packet loss rate Matt Kettler (Apr 25)
- Re: snort packet loss rate Jin Fang (Apr 26)
- Re: snort packet loss rate Justin Heath (May 10)
- Re: snort packet loss rate Jin Fang (Apr 26)
- Re: snort packet loss rate Justin Heath (May 10)
- Comparison of freebsd and linux [was: snort packet loss rate} Jin Fang (Apr 27)
- Re: Comparison of freebsd and linux [was: snort packet loss rate} Jin Fang (Apr 27)