Snort mailing list archives
Snort's configuration
From: "Santi Benito" <benisoroa () gmail com>
Date: Wed, 3 May 2006 11:47:34 +0200
Dear Snort users, I have written 3 times in snort`s users mailing list and anybody has answer my question and I am a little bit worried with my problem. I am analyzing real traffic with snort and I only use in snort.conf the rules referring to P2P and all the preprocessors active, when I replay traffic with tcpreplay at 100 Mb/s it drops the 96% of the packets and I have read that cancelling the preprocessors it could work better but it doesn`t. I don`t know how to change the memcap and also don`t know how to make snort to use libpcap with mmap that I have read that could be a good idea. Could anyone help me or say to me something? Santi ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort's configuration Santi Benito (May 03)
- Re: Snort's configuration Joel Esler (May 03)
- Re: Snort's configuration Paul Schmehl (May 03)