Snort mailing list archives
RE: 2.1.3rc1 Performance
From: "Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>
Date: Wed, 19 May 2004 16:25:43 -0500
I think the real question is... Is 0.8.3 really dropping packets? If it reports >100% drops, maybe it's not dropping at all and that counter is related to something else that's misconfigured. -----Original Message----- From: Gary_Portnoy () itginc com [mailto:Gary_Portnoy () itginc com] Sent: Wednesday, May 19, 2004 12:44 PM To: Kreimendahl, Chad J Cc: Dirk Geschke; snort-users () lists sourceforge net Subject: RE: [Snort-users] 2.1.3rc1 Performance Chad, Dirk, I kept recompiling and testing with different versions of libpcre and libpcap. And what do you know: Snort 2.1.3-RC1 with libpcre 4.5 and libpcap 0.8.3 reports dropping tons of packets Snort 2.1.3-RC1 with libpcre 4.5 and libpcap 0.7.2 reports dropping 0% of packets. I also noticed that Flushes/sec has gone down by a factor of 2 with 0.7.2 My problem is solved (I think....). The question remains however, which version is misreporting statistics? I suspect 0.8.3 since it reported 128.633% drop rate at one point. Or is 0.8.3 just that much slower? Anyone care to comment? -G ------------------------------------------- Gary Portnoy "Kreimendahl, Chad J" <Chad.Kreimendahl () umb com> 05/19/2004 12:55 PM To: <Gary_Portnoy () itginc com> cc: "Dirk Geschke" <Dirk_Geschke () genua de>, <snort-users () lists sourceforge net> Subject: RE: [Snort-users] 2.1.3rc1 Performance By the way... My tests were done with an older (not .8) version of libpcap. I'll attempt the new one in development very soon. -----Original Message----- From: Gary_Portnoy () itginc com [mailto:Gary_Portnoy () itginc com] Sent: Wednesday, May 19, 2004 11:46 AM To: Kreimendahl, Chad J Cc: Dirk Geschke; snort-users () lists sourceforge net Subject: RE: [Snort-users] 2.1.3rc1 Performance Heh.... And here I am running on a Sun Ultra-2, with dual processors, qfe card, and 1GB of Ram. I thought snort was keeping up, but apparently just barely. The maximum throughput i am seeing is about 5.5Mbps and 3k pkts/sec -g- ------------------------------------------- Gary Portnoy -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -+- This message is for the named person's use only. This communication is for informational purposes only and has been obtained from sources believed to be reliable, but it is not necessarily complete and its accuracy cannot be guaranteed. It is not intended as an offer or solicitation for the purchase or sale of any financial instrument or as an official confirmation of any transaction. Moreover, this material should not be construed to contain any recommendation regarding, or opinion concerning, any security. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. ITG Inc. reserves the right to monitor and archive all electronic communications through its network. ITG Inc. Member NASD, SIPC -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -+- ------------------------------------------------------- This SF.Net email is sponsored by: SourceForge.net Broadband Sign-up now for SourceForge Broadband and get the fastest 6.0/768 connection for only $19.95/mo for the first 3 months! http://ads.osdn.com/?ad_id%62&alloc_ida84&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: 2.1.3rc1 Performance, (continued)
- Re: 2.1.3rc1 Performance Gary_Portnoy (May 19)
- RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 19)
- RE: 2.1.3rc1 Performance Gary_Portnoy (May 19)
- RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 19)
- SnortCenter-Acid-SuSE byte_test issue Mike Feetham (May 19)
- Re: SnortCenter-Acid-SuSE byte_test issue AJ Butcher, Information Systems and Computing (May 20)
- SnortCenter-Acid-SuSE byte_test issue Mike Feetham (May 19)
- RE: 2.1.3rc1 Performance Gary_Portnoy (May 19)
- RE: 2.1.3rc1 Performance Dirk Geschke (May 19)
- RE: 2.1.3rc1 Performance Gary_Portnoy (May 19)
- RE: 2.1.3rc1 Performance Darren Webb (May 19)
- RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 19)
- RE: 2.1.3rc1 Performance John Creegan (May 19)
- RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 19)
- RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 20)
- RE: 2.1.3rc1 Performance snort user (May 20)
- RE: 2.1.3rc1 Performance Gary_Portnoy (May 20)
- RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 20)
- RE: 2.1.3rc1 Performance Gary_Portnoy (May 20)