Snort mailing list archives
Re: How to determine which detection search method to use?
From: Andy Berryman <aberryman () cymtec com>
Date: Tue, 9 Feb 2010 14:10:04 -0800
Thanks, that helps a lot! I'm getting around 190mb/sec? Feb 9 21:49:37 (none) snort[20351]: Mbits/Second Feb 9 21:49:37 (none) snort[20351]: ---------------- Feb 9 21:49:37 (none) snort[20351]: Snort: 224.155 Feb 9 21:49:37 (none) snort[20351]: Sniffing: 1371.216 Feb 9 21:49:37 (none) snort[20351]: Combined: 192.661 Feb 9 21:49:37 (none) snort[20351]: uSeconds/Pkt Feb 9 21:49:37 (none) snort[20351]: ---------------- Feb 9 21:49:37 (none) snort[20351]: Snort: 24.685 Feb 9 21:49:37 (none) snort[20351]: Sniffing: 4.035 Feb 9 21:49:37 (none) snort[20351]: Combined: 28.720 Feb 9 21:49:37 (none) snort[20351]: KPkts/Second Feb 9 21:49:37 (none) snort[20351]: ------------------ Feb 9 21:49:37 (none) snort[20351]: Snort: 40.511 Feb 9 21:49:37 (none) snort[20351]: Sniffing: 247.815 Feb 9 21:49:37 (none) snort[20351]: Combined: 34.819 Feb 9 21:49:37 (none) snort[20351]: Andy -----Original Message----- From: Jason Wallace [mailto:jason.r.wallace () gmail com] Sent: Tuesday, February 09, 2010 4:03 PM To: Andy Berryman Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] How to determine which detection search method to use? Yes, it uses a lot! I'm using... config detection: search-method ac and using 2.7GB of RAM and this network segment sees very little traffic. On Tue, Feb 9, 2010 at 4:48 PM, Andy Berryman <aberryman () cymtec com> wrote:
How can you determine which search method you should use? Reason I'm asking is right now I don't have one specified in my snort.conf so it's using the default of "ac-bnfa" But, if I specify "ac-std" I run out of memory in 15 seconds. This box has 2gb of memory and snort is the only thing running on it. The standard "ac-bnfa" never seems to get above 10% when I run the "top" command. So does the ac-std really use that much more memory? Thanks, Andy Berryman ------------------------------------------------------------------------------ SOLARIS 10 is the OS for Data Centers - provides features such as DTrace, Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW http://p.sf.net/sfu/solaris-dev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ SOLARIS 10 is the OS for Data Centers - provides features such as DTrace, Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW http://p.sf.net/sfu/solaris-dev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- How to determine which detection search method to use? Andy Berryman (Feb 09)
- Re: How to determine which detection search method to use? Joel Esler (Feb 09)
- Re: How to determine which detection search method to use? Jason Wallace (Feb 09)
- Re: How to determine which detection search method to use? Andy Berryman (Feb 09)