Snort mailing list archives
Re: porno rules -- portscan2 &c
From: Skip Carter <skip () taygeta com>
Date: Tue, 29 Apr 2003 16:16:33 -0700
I've only heard of one person who gets decent results with it (I think that's Erek) and that person admits their network is "not typical".Hmmm. Maybe there's two of us now .... ;-)
It would seem that those of use using it have not had much reason to speak up. I haven't had too much problem with it either. On a 733Mhz PIII (256Mb RAM) running OpenBSD 3.2: Snort analyzed 8722507 out of 8757313 packets, dropping 34806(0.397%) packets On a 300 Mhz PIII (128Mb RAM) running Linux 2.2.14: Snort analyzed 4506483 out of 4506483 packets, dropping 0(0.000%) packets
- spp_conversation and portscan2 will triple the memory requirements of snort 1.9.1, not sure about 2.x as it's general memory needs went up.I'm using 2.0.0 -- maybe it's better behaved.
I'm using 1.9.1 on both systems. Skip -- Dr. Everett (Skip) Carter Phone: 831-641-0645 FAX: 831-641-0647 Taygeta Scientific Inc. INTERNET: skip () taygeta com 1340 Munras Ave., Suite 314 WWW: http://www.taygeta.com Monterey, CA. 93940 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: porno rules -- portscan2 &c Neil Dickey (Apr 29)
- Re: porno rules -- portscan2 &c Skip Carter (Apr 29)
- Re: portscan2 effectiveness. Matt Kettler (Apr 29)
- Re: porno rules -- portscan2 &c Skip Carter (Apr 29)