Snort mailing list archives
Re: Performance again
From: Brian <bmc () snort org>
Date: Tue, 23 Dec 2003 10:04:45 -0500
On Tue, Dec 23, 2003 at 03:19:16PM +0100, Edin Dizdarevic wrote:
Therefore I took out some lines from my perfmon.log and tried to compare different situations, in which Snort were loosing packets. My first conclusion is, that the bigger the packets are, the more packets are being dropped, while the open sessions count has almost no influence. Interessting, that Snort will handle more than 700 sessions simultaneously with no packet loss :) (I only included the lines where packet drops occured).
Your method for coming to your conclusion is invalid. You can not ignore what happens before snort drops packets, as that is probably what is causing the drop. If you need finer grained information, set perfmonitor to dump its data more frequently. Brian ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Performance again Edin Dizdarevic (Dec 23)
- Re: Performance again Brian (Dec 23)
- Re: Performance again Edin Dizdarevic (Dec 23)
- Re: Performance again Matt Kettler (Dec 23)
- Re: Performance again Edin Dizdarevic (Dec 23)
- Re: Performance again Matt Kettler (Dec 23)
- Re: Performance again Lawrence Reed (Dec 23)
- Re: Performance again Edin Dizdarevic (Dec 23)
- Re: Performance again Matt Kettler (Dec 23)
- Re: Performance again Edin Dizdarevic (Dec 23)
- Re: Performance again Brian (Dec 23)