Low Snort performances

["Gianluca Murgia" <gianluca.murgia () datamat it>]

Hi,

I'm using snort 2.1 with a Dual Intel P3 1266MHz 2GB RAM, OS Redhat 7.3 (
kernel 2.4.18-3smp ). I use it to monitor the traffic on a fddi token ring
network. The traffic can be up to 50MB/s and the network cards are
SysKonnect SK-5844 10/100 Mb/s.

The snort config file is set to reassemble the packets.

The maximum rate I can sniff without loss of packets is up to 4Mb/s. What's
the problem? Is there any kind of important setting on the machine that is
missing? On the other hand, which settings or services must not be running
on the machine in order to improve the performances?


Thanks, Luca



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users