Re: Is there an acceptable amount of dropped packets for snort?

[Edin Dizdarevic <Snort () truesec de>]

AFAIC dropped packets are a problem when you detect false negatives (FN) 
- I'm not sure if the term FN is appropriate here btw. But there are so 
many other reasons that could lead to a FN.

Regarding metrics you might want to take a look into the Performance 
Monitor preprocessor which I used to deploy often when facing 
performance issues.

Rgrds,
Edin

Am 08.02.2010 21:55, schrieb Andy Berryman:
> Just wondering if there is a general acceptable amount of dropped
> packets for snort? Someone told me anything under around 10% would be
> acceptable. To me that's not right, any dropped packets to me is a
> big deal.
>
> Would this be considered acceptable? My interval for the stats
> reporting is every 30 seconds.

------------------------------------------------------------------------------
The Planet: dedicated and managed hosting, cloud storage, colocation
Stay online with enterprise data centers and the best network in the business
Choose flexible plans and management services without long-term contracts
Personal 24x7 support from experience hosting pros just a phone call away.
http://p.sf.net/sfu/theplanet-com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users