Snort inline latency

["Abdelmonaim Mokadem" <abdelmonaim.mokadem () abovesecurity com>]

Hi all,

I am currently trying to calculate my snort inline latency.

I have 2 hosts : one running snort inline and the other one which inject
pcaps (a bridge is set to send back packets from the snort host machine
to the injection one).

I use tcpdump to sniff packets at the emission and at the reception from
my injection host and (I match only ACK packets with a little program)
then calculate the difference between the timestamps (emission and
reception), but unfortunately my results are really bad...

Can anyone tell me if I'm doing right? Or does anyone know what is the
best way to calculate snort inline latency?

Thanks,

AM.

 

 

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!