Re: Snort Stats Output - Dropping 300%+ of Packets?

[JJC <cummingsj () gmail com>]

You are looking at Drop Rate not actual Drop Percentage...

You are actually losing 9.909%

On Thu, Sep 9, 2010 at 11:42 AM, Eoin Miller <
eoin.miller () trojanedbinaries com> wrote:

>  Looking for a little insight into how this log output is happening?
>
>
> 1284050396,304.464,13.100,0.909,2.172,753,393.233,32.793,24.839,25.264,26.018,6702,8192,400.594,931,5689,1.629,0.159,0.163,0.849,0.000,0.159,4282,8654,0,125,1,91.665,0.060,8.275,13.100,0.004,0.002,7.971,21.072,753,274,1415,2488,1023,2.172,0.002,0.000,0.400,2.573,506567,1542316,0,9.909,9.909,131067,131072,7079,4424,2816,3664,0.000,2.067,24.393,0.000,0.000,0,0,0.000,0,0.000,0,0,
>
> If I understand that correctly, 304% of packets were dropped?
>
> # snort --version
>
>    ,,_     -*> Snort! <*-
>   o"  )~   Version 2.8.6.1 IPv6 GRE (Build 39)
>    ''''    By Martin Roesch & The Snort Team:
> http://www.snort.org/snort/snort-team
>            Copyright (C) 1998-2010 Sourcefire, Inc., et al.
>            Using PCRE version: 7.4 2007-09-21
>            Using ZLIB version: 1.2.3.3
>
>
> -- Eoin
>
>
> ------------------------------------------------------------------------------
> This SF.net Dev2Dev email is sponsored by:
>
> Show off your parallel programming skills.
> Enter the Intel(R) Threading Challenge 2010.
> http://p.sf.net/sfu/intel-thread-sfd
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
This SF.net Dev2Dev email is sponsored by:

Show off your parallel programming skills.
Enter the Intel(R) Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users