Re: Performance issues with SNORT

[Ashley Thomas <athomas () unity ncsu edu>]

when you replay the traffic, at how much "rate in Mbps"  are you replaying
it ?




On Fri, 8 Feb 2002, Vikalp Nagori wrote:

> We are trying to benchmark Snort-1.8.3 running on HP P3 933MHZ , 512Mb RAM on linux.
>
> We ran tcpreplay on defcon dump and realized snort dropping 33% packets with default preprocessors and rules.
>
> We disabled all the preprocessors and rules still snort is dropping 20% packets.
>
>  would like to have inputs -
>
> 1. Are we in right direction? what is the best way of benchmarking snort?
> 2. What is the configuration of hardware expected by snort to give its best performance on 100Mbps network?
> 3. What is the optimum settings (ruleset, preprocessors and output plugin) to get efficient performance from snort 
> placed before firewall on 100Mbps network?
>
> Any help ???
>
>
> Vikalp Nagori


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users