Performance.

[Vjay LaRosa <vjayl () emc com>]

O.Kay,

I know that everyone probably hates this question, but I need to ask it
any way. I am running four instances
of snort. The first three run on a Fujitsu Prime Power M400, the fourth
runs on a linux PC. On my Solaris
host I have two 100MB cards that run close to 75% utilization each.
Snort barely even drops a single packet ever from
either of these cards. My third instance is reading off a Sun Gigabit
card. This interface only peaks periodically at 2% utilization, but I
drop hundreds of thousands of packets. I am using libpcap version 7.1,
snort 1.8.4 beta 4. The snort
process that is dropping all of the packets is only running at about 9%
CPU utilization. I have tried reducing signatures,
and removing output plugins, but nothing helps . Does anyone have any
suggestions for me to try? Thanks!

vjl



--
 V.Jay LaRosa                           EMC Corporation
 Systems Administrator                  171 South Street
 (508)435-1000 ext 14957                Hopkinton, MA 01748
 (508)497-8082 fax                      www.emc.com




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users