Re: Getting tuned finally!

[Joel Esler <eslerj () gmail com>]

Let us know your results!
J

On Wed, Mar 11, 2009 at 5:40 PM, Jefferson, Shawn <
Shawn.Jefferson () bcferries com> wrote:

>  I figured so.  My SYN + ACK are almost a single line on this sensor.
> I’ll increase the limit and see what it does.
>
>
>
> Thanks,
>
> Shawn
>
>
>  ------------------------------
>
> *From:* jesler () sourcefire com [mailto:jesler () sourcefire com] *On Behalf Of
> *Joel Esler
> *Sent:* March 11, 2009 2:39 PM
>
> *To:* Jefferson, Shawn
> *Cc:* Snort-users () lists sourceforge net
> *Subject:* Re: [Snort-users] Getting tuned finally!
>
>
>
> Give it a try.
>
>
>
> The reason I asked because if your sensor is outside the firewall, your SYN
> and SYN-ACK count won't line up, eating sessions.  That's why I was asking.
>
>
>
> J
>
> On Wed, Mar 11, 2009 at 5:25 PM, Jefferson, Shawn <
> Shawn.Jefferson () bcferries com> wrote:
>
> Hi,
>
>
>
> The sensor is on the inside of the firewall, but it’s fairly busy.
>
>
>
> Tracking more sessions sounds like a good thing… ?  Should I bump this up
> and monitor the performance?
>
>
>  ------------------------------
>
> *From:* jesler () sourcefire com [mailto:jesler () sourcefire com] *On Behalf Of
> *Joel Esler
> *Sent:* March 11, 2009 2:19 PM
> *To:* Jefferson, Shawn
> *Cc:* Snort-users () lists sourceforge net
> *Subject:* Re: [Snort-users] Getting tuned finally!
>
>
>
> If you increase this number, obviously it will allow you to track more
> sessions.  What is the placement of your sensor (inside or outside
> firewall?)
>
>
>
> J
>
> On Wed, Mar 11, 2009 at 4:55 PM, Jefferson, Shawn <
> Shawn.Jefferson () bcferries com> wrote:
>
> So I think I’m finally getting my snort sensor tuned so that I am achieving
> a balance between resources (not dropping any packets according to
> snorts.stats) and having some of the EmergingThreats rulesets enabled.  I do
> have some questions about the stream5 preprocessor though.
>
>
>
> I noticed that I was getting “faults” occasionally, and subsequent messages
> in the daemon.log about pruning sessions, so I increased the memcap limit
> until these went away.  Is this a “correct” action to take?
>
>
>
> Also, I noticed that my Open Sessions stats show open sessions to pretty
> much always be equal to max sessions, which is set at 8192.  Should I be
> increasing this, or is that normal behaviour?
>
>
>
> Thanks,
>
> Shawn
>
>
>
>
>
>
>
>
>
> ------------------------------------------------------------------------------
> Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
> powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
> easily build your RIAs with Flex Builder, the Eclipse(TM)based development
> software that enables intelligent coding and step-through debugging.
> Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0d%0aSnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
>
> --
> Joel Esler
> T: 302-223-5974 (-) Gtalk: jesler () sourcefire com
> [m]
>
>
>
>
> --
> Joel Esler
> T: 302-223-5974 (-) Gtalk: jesler () sourcefire com
> [m]



-- 
Joel Esler
T: 302-223-5974 (-) Gtalk: jesler () sourcefire com
[m]

------------------------------------------------------------------------------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based development
software that enables intelligent coding and step-through debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users