RE: 2.1.3rc1 Performance

[Dirk Geschke <Dirk () geschke-online de>]

Hi Gary,

> The question remains however, which version is misreporting statistics? I 
> suspect 0.8.3 since it reported 128.633% drop rate at one point.

hmm, drop/(recv+drop) shoule never exceed 100% or recv must be 
negative...

> Or is 0.8.3 just that much slower? 
>
> Anyone care to comment?

Can you verify how many packets were really on the wire
during your snort runs?

I think 'netstat -ni' should be helpful or a parallel snoop run 
on the sniffed interface. Maybe the old libpcap returned wrong
values?

Best regards

Dirk


-------------------------------------------------------
This SF.Net email is sponsored by: SourceForge.net Broadband
Sign-up now for SourceForge Broadband and get the fastest
6.0/768 connection for only $19.95/mo for the first 3 months!
http://ads.osdn.com/?ad_id=2562&alloc_id=6184&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users