RE: Low Snort performances

["Bob Walder" <bwalder () spamcop net>]

Hi,

In our most recent IDS tests (www.nss.co.uk/ids) we went way beyond the
traffic levels you are seeing here with no dropped packets whatsoever,
and we hit the sensor with some pretty tough background traffic that you
would not expect to see in a real network, as well as using lots of
"real world" scenarios.

We were using a dual P4 box with a server-class chipset, 2GB RAM and
Intel NICs. But I would venture to suggest that the specification you
outline below should be capable of handling 50Mbps with no problems, no
matter how many Snort rules you have enabled

At the risk of starting another OS war, I can say that one of the main
differences between our test rig and your sensor is that we used FreeBSD
for the underlying OS. We have tried installing Snort on Linux before
and noted a 500% performance hike when we moved to BSD on the same
platform. This was under an older kernel and without all that fancy ring
buffering PCAP stuff, but the results were enough to make us switch
permanently from Linux to BSD for our Snort sensors, and we have never
gone back to check difference with later versions.

Remember, I am not taking a pop at Red Hat or Linux here - just stating
facts.

The other major difference between our test rig and yours is the NICs
and underlying network plumbing, of course - another potential
bottleneck. Although I have seen good results form SysKonnect cards
before (we generally use Intel ourselves), we were using copper Ethernet
infrastructure and not FDDI Token Ring - perhaps there is an issue with
the cards and/or their Red Hat Linux drivers?

I would start by looking to update the drivers (are you using SysKonnect
drivers or those that are auto-installed by the OS?) - then maybe try
different NICs if that is possible. After that, you could try switching
to BSD if you are so inclined.

But in general, your sensor spec looks OK and there is not TOO much
tuning you can do in terms of Snort or disabling OS services (you should
disable everything you don't use, anyway) that is likely to make the
kind of difference you are looking for

Regards,

Bob Walder
Director
The NSS Group





> > -----Original Message-----
> > From: snort-users-admin () lists sourceforge net 
> > [mailto:snort-users-admin () lists sourceforge net] On Behalf 
> > Of Gianluca Murgia
> > Sent: 19 April 2004 11:02
> > To: snort-users () lists sourceforge net
> > Subject: [Snort-users] Low Snort performances
> >
> >
> > Hi,
> >
> > I'm using snort 2.1 with a Dual Intel P3 1266MHz 2GB RAM, OS 
> > Redhat 7.3 ( kernel 2.4.18-3smp ). I use it to monitor the 
> > traffic on a fddi token ring network. The traffic can be up 
> > to 50MB/s and the network cards are SysKonnect SK-5844 10/100 Mb/s.
> >
> > The snort config file is set to reassemble the packets.
> >
> > The maximum rate I can sniff without loss of packets is up 
> > to 4Mb/s. What's the problem? Is there any kind of important 
> > setting on the machine that is missing? On the other hand, 
> > which settings or services must not be running on the 
> > machine in order to improve the performances?
> >
> >
> > Thanks, Luca
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by: IBM Linux Tutorials
> > Free Linux tutorial presented by Daniel Robbins, President 
> > and CEO of GenToo technologies. Learn everything from 
> > fundamentals to system 
> > administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe: 
> > > > https://lists.sourceforge.net/lists/listinfo/sno>> rt-users
> >
> >
> > Snort-users list archive: 
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users