Snort mailing list archives

How To Measure Promiscuous Mode ...


From: John Crain <port123tcp () yahoo com>
Date: Thu, 24 Jul 2003 05:24:49 -0700 (PDT)

I read that placing an interface in promiscuous mode increases system utilization, but I didn't find any specifics. 
Does anyone have any suggestions on how to measure the impact on a system by placing an interface in promiscuous mode?
 
Q1: Would the impact on the system be dependent on the number of packets the system had to process?
 
Q2: To take accurate measurements, would you agree that a packet generator would be necessary for testing?
 
Q3: If yes to Q2, is it possible to build a packet generator to spit out the exact same type and number of packets for 
repeated testing?
 
Q4: If a sensor interface with no IP address is attached to a SPAN port, does the sensor interface need to be in 
promiscuous mode? (I don't believe it does since all packets on the switch/router are being shot at the sensor and the 
sensor has no IP address to discern.)
 
Q5: If a sensor interface with an IP address is attached to a SPAN port and the interface is not in promiscuous mode, 
will the sensor interface be able to "see" all packets from the SPAN port?
 
Thanks.
 
-John


---------------------------------
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.

Current thread: