Snort mailing list archives

Snort dropping packets


From: "KS" <kanwaljeet () emind com>
Date: Mon, 2 Feb 2004 23:10:25 +0530

Guys,

I have a Dual processor Dell poweredge 1600SC box having intel Xeon 2Ghz
processors and 128 Meg Ram and it is running snort win32 version.  I can see
a lot of alerts on acid console and cpu utlization of the box remains within
5 %.

I have snort running in service mode  with following comand line through IDS
centre.

c:\Snort\bin\snort.exe -c "c:\Snort\etc\snort.conf" -l "c:\Snort\log" -i 1

Quite interestingly When i run snort in VERBOSE mode using   snort -v -i1 on
the command prompt, i can see snort logging packets and  when i stop it, it
shows dropped packets and cpu utlization of the box, when i run snort in
verbose mode, goes to 45- 50%

============================================================================
===

Snort analyzed 9094 out of 10327 packets,
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ dropping 1233(11.306%) packets

Is it possible that snort is dropping packets only in verbose mode and not
otherwise ?

Appreciate any help on this.

Below are few lines taken from snort website :

" If Snort is going to be used in a long term way as an IDS, the -v switch
should be left off the command line for the sake of speed. The screen is a
slow place to write data to, and packets can be dropped while writing to the
display. "


Thanks
KS


Current thread: