Re: snort under high density traffic

[Edin Dizdarevic <edin.dizdarevic () interActive-Systems de>]

Hi,

Mehmet Ersan TOPALOGLU wrote:
> > Mehmet Ersan TOPALOGLU wrote:
[...]
> Yes i again take wrong statistics.

Hm, actually that shouldn't be.

I would advise you to connect the sensor and the sender with a
crossover cable and then use tcpreplay to send out the packets.

Remember the stats you get from tcpreplay.

After that kill SIGUSR1 Snort and get the stats.

Is there any difference then?

Please post the outputs here.

> Should i be sending the dump files to you only?
> And one problem is the size, they are not small around 100Mb each.

We'll try that later...

Regards,

Edin

-- 
Edin Dizdarevic



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users