Snort solaris perfs

[Cedric Guillotin <guillo_c () fluxus net>]

Hi everyone,

In my difficult Quest to get some figures about snort perfs i'm facing a
strange problem.
I tried to bench it on different systems, and procs. I generate some
traffic at
differents fixed rates with tcpreplay, another host listens with snort
1.8-beta4 build 18, 1600 rules and some preprocessors.

FreeBSD 4.2, Linux (2.2.18), OpenBSD 2.8 on a PIII with a 3C905B NIC
seems to handle a 2Mb load with no loss.
Above 2Mb of load, the received number doesn't match the sent numbers of
tcpreplay.

What suprises me the most, is that I get 30% loss at 10Mb on a PIII
FreeBSD, and 75% of loss with a Netra T1 solaris 2.6 !!! Why such a bad
perf ?

To get these figures I use the information given by snort received and
drop, but on Solaris and linux I can't get the drop figures. So when I
say my host can handle 2Mb I rely on snort stats.

During the test I also found an impressive difference between snort 1.7
(95% loss at 10Mb OpenBSD PII400 3C905C) and 1.8 (46% loss at 10Mb
OpenBSD PII400 3C905C)

Does anyone has perform similar bench? Share please... 
-- 
Fluxus est une société BT Ignite 
Phone : +33.1.44.97.70.00 - Fax : +33.1.44.97.70.14
30, rue du Chateau des Rentiers - 75013 PARIS

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users