snort under high density traffic

[Mehmet Ersan TOPALOGLU <mersan () ceng metu edu tr>]

Hi,
I use snort to test my thesis but i got stalled at some point.
For normal rates of traffic snort doesn't loose any packets.
It gives an output like
"Snort analysed 1616530 packets out of 1616530, dropping 0 ..."
But if the trafiic density increases it starts to drop the packets.
Everything is normal till now.
But in a controlled test environment i play scenerios with tcpreplay.
Environment is a closed one computers are connected via Cisco Catalyst 
2900XL switch. and the machine i am runnig snort is connected to 
monitoring port of the switch.
I play the scenerio with 1600000 packets at a rate of 1Mbit/s
snort don't loose any packets and gives results as expected.
"Snort analysed 1601000 packets out of 1601000 packets dropping 0..."
slightly increase in number of packet is expected.
But if i increase the speed for example 3 machines replaying different 
scenerios at 30 Mbit/s each counters of snort get confused.
I sent total of 4800000 packets to the network and snort reports at the end.
"Snort analysed 3800000 packets out of 7000000 packets dropping ...."
I am sure LAN is isolated no other packets can come from outside and
$cat /proc/net/dev
says 3800000 packet received.

Story is the same when i use one packet dumper via tcpreplay at 30Mbit/s.
Dropping packets is normal but total packets exceed with a great amount 
that sent in the LAN.

What can be the reason for that?

I am using Snort v1.9
and redhat 9 linux PC with kernel 2.4.20.
and libpcap v0.7

I would be pleased if you help
Thanks in advance

--
- mersan
    mersan () ceng metu edu tr
    mersan () metu edu tr

        Budi srecna. Meni je to dovoljno.



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users