Re: network bandwidth downs when snort inoine is up

[Victor Julien <lists () inliniac net>]

carlopmart wrote:
> Yes: norm_wscale_max 14
>   
This should be ok. Can you past your entire stream4 config?

It doesn't have to be a stream4inline issue though. The number of sigs,
preprocessors, etc. can also slow things down. Especially the clamav
preproc.

Regards,
Victor


> Will Metcalf wrote:
>   
> > do you have window normalization enabled in your stream4inline config?
> >
> > On 10/9/07, carlopmart <carlopmart () gmail com> wrote:
> >     
> > > hi all,
> > >
> > >   I have configured a snort inline on my home network. (i am using
> > > clamav preprocessor on it). First problem is bandwidth: downs from 310
> > > kb to 166 kb (previosly exists some fluctuations) ... Is this normal?
> > > Can I set up some kernel param to increase this bandwidth?? I am using
> > > rhel5 and snor-inline 2.6.1.5
> > >
> > > Many thanks.
> > >
> > > --
> > > CL Martinez
> > > carlopmart {at} gmail {d0t} com
> > >
> > > -------------------------------------------------------------------------
> > > This SF.net email is sponsored by: Splunk Inc.
> > > Still grepping through log files to find problems?  Stop.
> > > Now Search log events and configuration files using AJAX and a browser.
> > > Download your FREE copy of Splunk now >> http://get.splunk.com/
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > >
> > >       
>
>
>   


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users