IDS mailing list archives
RE: SNORT Testing
From: "Terry Vernon" <tvernon24 () comcast net>
Date: Thu, 2 Mar 2006 04:07:58 -0600
I've been doing some benchmarking lately on snort packet loss and have found great success using netstrain to load the line. I'm not looking at attack detection right now as much as I am squeezing every last drip of performance out. What I do is start up 2 or 3 sets of netstrain, watch the system with "top", then I start snort without -D and let it run for a bit before I ctrl+c it. I check the dropped packets percentage and modify things trying to get it smaller and smaller. I keep an eye on top to make sure the system isn't loading abnormally. I also watch the speeds in netstrain for slow or spiked traffic. It's not an exact method but works for me and is a fun way to kill time. I imagine once I'm satisfied or I reach the limit I will more than likely load the network as before and start sending exploits, various scanning, etc... That's how I test snort without spending a dime. -Terry -----Original Message----- From: Byron Sonne [mailto:blsonne () rogers com] Sent: Wednesday, March 01, 2006 8:56 PM To: focus-ids () securityfocus com Subject: Re: SNORT Testing
The tools that come to mind for me are 'stick' and 'snot': http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0096.html
Folks... I never said they were good tools! As far as I'm concerned, the only test that matters is a real world one. Every network is different, sometimes radically, and I don't see much of a point trying to generalize these kinds of things with a test suite. Artificial tests give you artificial results. ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- Re: SNORT Testing Martin Roesch (Mar 01)
- Re: SNORT Testing Eric Hines (Mar 03)
- <Possible follow-ups>
- Re: SNORT Testing Richard Bejtlich (Mar 01)
- Re: SNORT Testing Dirk Geschke (Mar 03)
- Re: SNORT Testing Aaron Turner (Mar 02)
- Re: SNORT Testing Byron Sonne (Mar 02)
- RE: SNORT Testing Terry Vernon (Mar 03)
- Re: SNORT Testing Stefano Zanero (Mar 09)
- RE: SNORT Testing Terry Vernon (Mar 03)