Re: BPF/libpcap performance, was Re: Seg Fault

[Erek Adams <erek () theadamsfamily net>]

On Tue, 26 Feb 2002, Ashley Thomas wrote:

> the packets that Snort processes does'nt touch the tcp/ip stack so would
> those parameters matter ??
>
> all the packets to snort is directly from libpcap which is from the
> interface ...

Right...  I guess I should have been more specific in what I was asking...  :)

Many folks use some of the blueprint settings from the "Solaris Operating
Environment Network Settings for Network Security"
http://www.sun.com/blueprints/1200/network-updt1.pdf.  I'm wondering should I
rework my jumpstarts to provide for a less tweaked version for a sensor.  Or
if I should just continue to use the 'normal' settings that I've got configed
already.

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users