RE: packet size

["Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>]

Maybe you meant to reverse those small/large..

The biggest difference between smaller and larger packets as it relates
to snort and libpcap is really the interrupts it generates.  At 20Mbps
with large packets, most systems can handle that... but if you pump 3-4
times the packets down the pipe, you're likely to see drops and
livelock.  In snort 2.x user CPU doesn't ever appear so great as to
cause a problem in either scenario.  

-----Original Message-----
From: Mehmet Ersan TOPALOGLU [mailto:mersan () ceng metu edu tr] 
Sent: Monday, August 25, 2003 6:27 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] packet size


In case of constant, for example 20Mbit/s rate, network traffic.
What is the difference between large packets and small packets
for snort and for libpcap?

e.g: first case: large packets -> 5000packet/s with 20Mbit/s rate
      second case: small packets -> 20.000 packets/s with 20Mbit/s rate

-- 
- mersan
     mersan () ceng metu edu tr
     mersan () metu edu tr

        Budi srecna. Meni je to dovoljno.



-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click
here:http://www.vmware.com/wl/offer/358/0
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users