Snort mailing list archives
Tweaking promiscous mode sniffing performance
From: Martin Olsson <elof () sentor se>
Date: Wed, 29 Sep 2004 10:47:48 +0200 (CEST)
I'm trying to get the most out of my FreeBSD 4.x machine, and now I have a question: When an interface is put into promiscous mode, it forwards all received packets to the kernel. The kernel (the IP stack) will check each packet to see if it is addressed to the local machine. My snort is listening to a Span-port which generate about 600 Mbps of traffic. Not a single one of these billions of packets are addressed to the sniffer machine. I think it is pretty unneccesary for the kernel to waste CPU on all these packets. (not only is the IP stack checking them, maybe you have a firewall and ipsec configuration that the billions of packets are matched against) Is there any way to tell the kernel not to process the incoming packets on a given interface, while sniffer programs still can read the raw data? (My sniffer interface have no IP address. Another interface, the management interface, do have an IP address and on that interface I want the kernel to process all packets.) /Elof ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Tweaking promiscous mode sniffing performance Martin Olsson (Sep 29)