RE: dropping packets

["Basselgia, Barry A Mr (NAF Atsugi)" <BABasselgia () atsugi navy mil>]

I can't explain the technical reasons why the packets are being dropped.
There are a lot of attempts to explain this if you check the mail list
archive or search google.

I can suggest a solution.  Upgrade your libpcap to the mmap version.  Again,
if you search on google you'll find a info on this.

I had about the same stats you have, upgraded libpcap and now I get 0%
dropped packets.  That's not to say it doesn't drop any packets, but the
number is so small the stats show as 0%.

Barry

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of
hchlai () netscape net
Sent: Thursday, January 27, 2005 2:32 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] dropping packets


I have realized that Snort has been dropping packets even I'm running it
inconjuction with Barnyard. Does anybody know what causes Snort to drop
packets? I'm running Barnyard with these options:

barnyard -c -d -g -f -s -n -w -a

and Snort with the following:

snort -c -i -g -Dv

I'm recording about 1%-2% of packets being dropped by Snort... sometimes as
high as 6%. Many thanks!

Hugo


__________________________________________________________________
Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register

Netscape. Just the Net You Need.

New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users